Błąd explorer.exe - message system, click for details

**Posty:** 346 · przez **Dead** 07 Sie 2008, 20:13

Witam!

Z góry przepraszam, jezeli nieodpowiedni dział, lecz nie wiedzialem gdzie topic umieścić

.

Gdy wchodzę w moj komputer, i na jedna z parycji. Wyskakuje mi w pasku obok godziny zolty kwadracik "message system, click for detalis" klikam, nic sie nie dzieje. Po kilku chwilach wystepuje blad programu explorer.exe Wylacza mi sie pasek startu i moj komputer ;/.

**Posty:** 7956 · przez **Magik** 07 Sie 2008, 20:24

Wklej logi z combofix'a i HJT

jak-generujemy-logi-z-combofixa-oraz-dssa-vt95026.html

hijackthis-silent-runners-obsluga-i-umieszczanie-vt9452.html

**Posty:** 346 · przez **Dead** 07 Sie 2008, 23:05

Kod: Zaznacz wszystko: ComboFix 08-07-29.1 - Dead 2008-08-07 23:00:24.2 - NTFSx86 Running from: C:\Documents and Settings\Dead\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\17PHolmes1001186.exe C:\WINDOWS\b128.exe C:\WINDOWS\b152.exe C:\WINDOWS\mrofinu_upx.exe C:\WINDOWS\mrofinu1001186.exe C:\WINDOWS\mrofinu1001186.exe.tmp C:\WINDOWS\system32\avifil.dll . ((((((((((((((((((((((((( Files Created from 2008-07-07 to 2008-08-07 ))))))))))))))))))))))))))))))) . 2008-07-31 00:41 . 2008-07-31 00:41 <DIR> d-------- C:\Program Files\MSBuild 2008-07-31 00:33 . 2008-07-31 00:33 <DIR> d-------- C:\WINDOWS\system32\XPSViewer 2008-07-31 00:28 . 2008-07-31 00:28 <DIR> d-------- C:\Program Files\Reference Assemblies 2008-07-31 00:25 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll 2008-07-30 16:59 . 2008-07-30 16:59 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-30 14:22 . 2008-07-30 17:08 <DIR> d-------- C:\SDFix 2008-07-30 13:18 . 2008-07-30 13:18 <DIR> d-------- C:\Program Files\Trend Micro 2008-07-29 23:01 . 2008-07-29 23:01 <DIR> d-------- C:\WINDOWS\Sun 2008-07-29 23:00 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-07-29 22:58 . 2008-07-29 23:00 <DIR> d-------- C:\Program Files\Java 2008-07-29 22:56 . 2008-07-29 22:56 <DIR> d-------- C:\Program Files\Common Files\Java 2008-07-29 14:32 . 2008-07-29 14:32 0 --a------ C:\WINDOWS\nsreg.dat 2008-07-29 14:16 . 2008-07-31 10:55 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-07-29 14:16 . 2004-08-04 00:43 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll 2008-07-29 14:15 . 2008-08-05 19:58 <DIR> d-------- C:\WINDOWS\system32\FTCOMModule 2008-07-29 14:15 . 2003-08-04 14:22 94,208 --a------ C:\WINDOWS\system32\W32n50.dll 2008-07-29 14:15 . 2004-06-10 16:20 53,248 --a------ C:\WINDOWS\system32\FTRTSVC.exe 2008-07-29 14:15 . 2005-10-06 15:27 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll 2008-07-29 14:15 . 2003-08-04 14:22 16,128 --------- C:\WINDOWS\system32\PCANDIS5.SYS 2008-07-29 14:14 . 2008-07-29 14:14 <DIR> d-------- C:\Program Files\FranceTelecomUninstall 2008-07-29 14:10 . 2008-07-29 14:10 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-07-29 14:06 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\[u]0[/u]00001_.tmp 2008-07-29 14:05 . 2006-05-29 10:52 112,000 --a------ C:\WINDOWS\system32\drivers\Gtm51Irp.sys 2008-07-29 14:05 . 2006-05-29 10:52 25,344 --a------ C:\WINDOWS\system32\drivers\gtmmdmusb.sys 2008-07-29 14:05 . 2006-10-16 16:10 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-07-29 14:05 . 2006-05-29 10:52 21,760 --a------ C:\WINDOWS\system32\drivers\gtmserusb.sys 2008-07-29 14:05 . 2006-05-29 10:52 19,328 --a------ C:\WINDOWS\system32\drivers\gtscser.sys 2008-07-29 14:05 . 2006-05-29 10:52 16,128 --a------ C:\WINDOWS\system32\drivers\gtffbus.sys 2008-07-29 14:05 . 2006-05-29 10:52 8,064 --a------ C:\WINDOWS\system32\drivers\gtptser.sys 2008-07-29 14:05 . 2006-05-29 10:52 5,120 --a------ C:\WINDOWS\system32\drivers\GtVUsb.sys 2008-07-29 14:02 . 2008-08-05 19:58 <DIR> d-------- C:\Program Files\OrangeBs . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-31 12:40 --------- d-----w C:\Program Files\Gadu-Gadu 2008-07-29 18:57 --------- d-----w C:\Program Files\Winamp 2008-07-29 12:13 --------- d-----w C:\Program Files\Alwil Software 2008-07-29 11:58 --------- d-----w C:\Program Files\AC3Filter 2008-07-29 11:55 --------- d-----w C:\Documents and Settings\Dead\Dane aplikacji\Gadu-Gadu 2008-07-29 11:52 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-29 11:52 --------- d-----w C:\Program Files\Realtek Sound Manager 2008-07-29 11:52 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-07-29 11:52 --------- d-----w C:\Program Files\AvRack 2008-07-29 11:44 --------- d-----w C:\Program Files\microsoft frontpage 2008-07-29 11:41 --------- d-----w C:\Program Files\Usługi online . ------- Sigcheck ------- 2004-08-04 00:44 1044992 8c8e47269c27d89f101d52b9c57633fa C:\WINDOWS\explorer.exe 2004-08-04 00:44 1033728 379098a96e6c165b659de7e4328010ea C:\WINDOWS\ServicePackFiles\i386\explorer.exe 2004-08-04 00:44 1033728 379098a96e6c165b659de7e4328010ea C:\WINDOWS\system32\dllcache\explorer.exe 2004-08-04 00:44 57856 bebe8a85954ff460374fd5a0cd21e19b C:\WINDOWS\ServicePackFiles\i386\spoolsv.exe 2004-08-04 00:44 69120 0f7e8de4fdc82206e04a86b5820f86b5 C:\WINDOWS\system32\spoolsv.exe 2004-08-04 00:44 57856 bebe8a85954ff460374fd5a0cd21e19b C:\WINDOWS\system32\dllcache\spoolsv.exe . ((((((((((((((((((((((((((((( snapshot@2008-07-30_17.16.38.03 ))))))))))))))))))))))))))))))))))))))))) . + 2008-07-30 22:28:43 151,552 ----a-w C:\WINDOWS\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll + 2008-07-30 22:32:55 3,915,776 ----a-w C:\WINDOWS\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll + 2008-07-30 22:33:03 344,064 ----a-w C:\WINDOWS\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll + 2008-07-30 22:28:43 352,256 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll + 2008-07-30 22:32:54 593,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\PresentationBuildTasks.dll + 2008-07-30 22:32:55 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\PresentationCFFRasterizer.dll + 2008-07-30 22:33:02 184,320 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll + 2008-07-30 22:33:01 126,976 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationFramework.Classic\3.0.0.0__31bf3856ad364e35\PresentationFramework.Classic.dll + 2008-07-30 22:33:01 376,832 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationFramework.Luna\3.0.0.0__31bf3856ad364e35\PresentationFramework.Luna.dll + 2008-07-30 22:33:02 151,552 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationFramework.Royale\3.0.0.0__31bf3856ad364e35\PresentationFramework.Royale.dll + 2008-07-30 22:32:57 4,972,544 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll + 2008-07-30 22:32:58 897,024 ----a-w C:\WINDOWS\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\PresentationUI.dll + 2008-07-30 22:33:02 528,384 ----a-w C:\WINDOWS\assembly\GAC_MSIL\ReachFramework\3.0.0.0__31bf3856ad364e35\ReachFramework.dll + 2008-07-30 22:28:44 94,208 ----a-w C:\WINDOWS\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll + 2008-07-30 22:28:45 126,976 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.IdentityModel.Selectors\3.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll + 2008-07-30 22:28:45 401,408 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll + 2008-07-30 22:28:46 131,072 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.IO.Log\3.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll + 2008-07-30 22:28:49 884,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll + 2008-07-30 22:28:58 159,744 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceModel.Install\3.0.0.0__b77a5c561934e089\System.ServiceModel.Install.dll + 2008-07-30 22:28:58 16,384 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll + 2008-07-30 22:28:56 5,623,808 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll + 2008-07-30 22:33:03 688,128 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Speech\3.0.0.0__31bf3856ad364e35\System.Speech.dll + 2008-07-30 22:41:20 1,108,784 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Workflow.Activities\3.0.0.0__31bf3856ad364e35\System.Workflow.Activities.dll + 2008-07-30 22:41:20 1,641,272 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Workflow.ComponentModel\3.0.0.0__31bf3856ad364e35\System.Workflow.ComponentModel.dll + 2008-07-30 22:41:20 588,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Workflow.Runtime\3.0.0.0__31bf3856ad364e35\System.Workflow.Runtime.dll + 2008-07-30 22:33:00 163,840 ----a-w C:\WINDOWS\assembly\GAC_MSIL\UIAutomationClient\3.0.0.0__31bf3856ad364e35\UIAutomationClient.dll + 2008-07-30 22:33:01 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\UIAutomationClientsideProviders\3.0.0.0__31bf3856ad364e35\UIAutomationClientsideProviders.dll + 2008-07-30 22:33:00 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\UIAutomationProvider\3.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll + 2008-07-30 22:32:59 86,016 ----a-w C:\WINDOWS\assembly\GAC_MSIL\UIAutomationTypes\3.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll + 2008-07-30 22:32:54 1,167,360 ----a-w C:\WINDOWS\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll + 2008-07-30 22:33:04 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\WindowsFormsIntegration\3.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll + 2008-07-31 23:10:06 405,504 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\47ce4b3883e36747b90d837438a72ecd\Microsoft.Transactions.Bridge.Dtc.ni.dll + 2008-07-31 23:10:02 1,069,056 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\68e3f29b9a55794aabab5df6026cf8a7\Microsoft.Transactions.Bridge.ni.dll + 2008-07-30 22:34:02 17,920 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\887e499909835b42b9a71167f94e486c\Microsoft.VisualC.ni.dll + 2008-07-31 23:20:41 1,576,960 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\e9919beeede38e4aa4ed844bc7254899\PresentationBuildTasks.ni.dll + 2008-07-30 22:36:11 40,448 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\aaa2fac278cc244c8b797120499c3fec\PresentationCFFRasterizer.ni.dll + 2008-07-30 22:36:09 12,038,144 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationCore\5246e12685b1474e9c02d5bf51d92a8d\PresentationCore.ni.dll + 2008-07-30 22:40:59 204,800 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\31134f75c334e4438dc4de438e71c95a\PresentationFramework.Classic.ni.dll + 2008-07-30 22:41:07 393,216 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\5a09dadf51cf254fbb665ba27577d728\PresentationFramework.Aero.ni.dll + 2008-07-30 22:41:04 266,240 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\89a6974051146b40a81bd79306b1c6c9\PresentationFramework.Royale.ni.dll + 2008-07-30 22:41:02 548,864 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\bdfbed46cf19f549b5bf027788d7a068\PresentationFramework.Luna.ni.dll + 2008-07-30 22:40:02 14,643,200 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\c83e6adf6cbad44caaaa11f059b56c3a\PresentationFramework.ni.dll + 2008-07-30 22:40:19 1,757,184 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationUI\a1eb1151ebdcd64e9391bcc90ecfab73\PresentationUI.ni.dll + 2008-07-30 22:40:50 2,338,816 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\ReachFramework\21e39edd93edce49815888f28a236d95\ReachFramework.ni.dll + 2008-07-31 23:10:30 286,720 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\89cd8713858ca6469b25da16fed4a02f\SMDiagnostics.ni.dll + 2008-07-31 23:21:18 262,144 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\sysglobl\e92bc7e9128b5d4e8bc01dcd92f6d312\sysglobl.ni.dll + 2008-07-30 22:34:16 167,936 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\50ecfa6a8d6eb042b5eefcdf0aada0eb\System.Configuration.Install.ni.dll + 2008-07-30 22:34:14 1,179,648 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\[u]0[/u]99d1595630e064e9f832afe289cb42d\System.Data.OracleClient.ni.dll + 2008-07-30 22:34:02 2,703,360 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\f665a8c4ee612f4ca68946eccf0f0015\System.Data.SqlXml.ni.dll + 2008-07-31 08:53:26 237,568 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\61082982d611ec48aa5236e5a0264356\System.IdentityModel.Selectors.ni.dll + 2008-07-31 08:53:25 995,328 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\1c97433f8d0fdc4cb8989cf01aa0a6e6\System.IdentityModel.ni.dll + 2008-07-31 08:53:29 425,984 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.IO.Log\91ada53d8663d2418e157e5e600a3c5f\System.IO.Log.ni.dll + 2008-07-30 22:42:22 655,360 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Messaging\a0502df728686544ab5cd8e2b26b4004\System.Messaging.ni.dll + 2008-07-30 22:40:56 1,052,672 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Printing\155f949f324f4840a9b7541245c59724\System.Printing.ni.dll + 2008-07-30 22:34:06 815,104 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\c5f252d4f8328a45ad786904cc4b6a94\System.Runtime.Remoting.ni.dll + 2008-07-30 22:34:08 339,968 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\79f61afab5491f4297a8eb8536c2e428\System.Runtime.Serialization.Formatters.Soap.ni.dll + 2008-07-31 08:53:39 2,371,584 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\7b90b6b04303c74abe67ace9b4f6022d\System.Runtime.Serialization.ni.dll + 2008-07-31 23:08:32 17,506,304 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\13f6ebd0fd3a8b4a93ee7d1b20539f66\System.ServiceModel.ni.dll + 2008-07-30 22:34:15 233,472 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\6ff533b6b322d5488f3d9d5dfb012ff4\System.ServiceProcess.ni.dll + 2008-07-31 23:21:12 2,043,904 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Speech\bbf951c6ee25b542b642d0d0c3b4bab6\System.Speech.ni.dll + 2008-07-30 22:41:40 2,965,504 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\9088a3d3b367b44782b12704f0a2eddc\System.Workflow.Activities.ni.dll + 2008-07-30 22:42:06 4,599,808 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\d6fcc7d6ca806040bfe3bcade08ec26a\System.Workflow.ComponentModel.ni.dll + 2008-07-30 22:42:19 2,064,384 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\61bf6e53f124044d9247462a2f93628f\System.Workflow.Runtime.ni.dll + 2008-07-31 23:21:26 483,328 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\3043394a039c9e4fab0a1098218681fd\UIAutomationClient.ni.dll + 2008-07-31 23:21:39 1,122,304 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\c31889326aaf1c41a6ab12b57ca4b86d\UIAutomationClientsideProviders.ni.dll + 2008-07-30 22:36:10 51,200 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\91413e8775402e4cbcaffc9df3494a7c\UIAutomationProvider.ni.dll + 2008-07-30 22:36:11 196,608 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\70283f7efcd0874e836e482218641340\UIAutomationTypes.ni.dll + 2008-07-30 22:33:48 3,289,088 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\WindowsBase\2e63843b7726844f82a87559011d424d\WindowsBase.ni.dll + 2008-07-31 23:19:38 245,760 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\5cabed2c0c87934a814cd21bcf9dca2f\WindowsFormsIntegration.ni.dll - 2005-01-28 14:13:20 192,512 ----a-w C:\WINDOWS\inf\unregmp2.exe + 2005-01-28 14:13:20 237,568 ----a-w C:\WINDOWS\inf\unregmp2.exe - 2005-09-23 05:28:38 4,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe + 2005-09-23 05:28:38 48,640 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe + 2006-10-30 02:06:24 74,012 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\baseline.dat + 2006-10-30 01:25:56 99,600 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\DeleteTemp.exe + 2006-10-29 21:15:06 220,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\dlmgr.dll + 2006-10-29 21:17:56 1,054,720 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\gencomp.dll + 2006-10-29 21:14:26 163,328 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\HtmlLite.dll + 2006-10-30 01:25:54 194,320 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\RebootStub.exe + 2006-10-30 01:25:56 167,176 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\runmsi.exe + 2006-10-30 01:25:56 365,320 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setup.exe + 2006-10-30 01:17:12 80,384 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1025.dll + 2006-10-30 01:17:30 80,384 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1028.dll + 2006-10-30 01:17:36 86,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1029.dll + 2006-10-30 01:17:44 87,040 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1030.dll + 2006-10-30 01:17:50 89,600 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1031.dll + 2006-10-30 01:17:56 94,208 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1032.dll + 2006-10-30 01:18:10 82,944 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1035.dll + 2006-10-30 01:18:16 91,648 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1036.dll + 2006-10-30 01:18:22 80,384 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1037.dll + 2006-10-30 01:18:30 89,600 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1038.dll + 2006-10-30 01:18:36 88,064 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1040.dll + 2006-10-30 01:18:42 80,384 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1041.dll + 2006-10-30 01:18:48 80,384 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1042.dll + 2006-10-30 01:18:56 87,040 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1043.dll + 2006-10-30 01:19:02 83,968 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1044.dll + 2006-10-30 01:19:08 86,528 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1045.dll + 2006-10-30 01:19:14 84,480 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1046.dll + 2006-10-30 01:19:28 82,944 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1049.dll + 2006-10-30 01:19:34 83,968 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1053.dll + 2006-10-30 01:19:42 82,432 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1055.dll + 2006-10-30 01:17:24 80,384 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.2052.dll + 2006-10-30 01:19:22 90,624 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.2070.dll + 2006-10-30 01:18:02 90,112 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.3082.dll + 2006-10-29 21:15:20 80,384 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.dll + 2006-10-29 21:15:22 1,621,504 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\SITSetup.dll + 2006-10-29 21:16:52 1,139,712 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\vs_setup.dll + 2006-10-29 21:18:26 590,848 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\vs70uimgr.dll + 2006-10-29 21:20:20 541,184 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\vsbasereqs.dll + 2006-10-29 21:18:12 816,128 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\vsscenario.dll + 2006-10-30 01:17:14 98,816 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1025.dll + 2006-10-30 01:17:30 98,816 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1028.dll + 2006-10-30 01:17:38 99,840 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1029.dll + 2006-10-30 01:17:44 99,840 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1030.dll + 2006-10-30 01:17:50 102,400 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1031.dll + 2006-10-30 01:17:58 104,448 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1032.dll + 2006-10-30 01:18:10 98,816 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1035.dll + 2006-10-30 01:18:16 103,424 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1036.dll + 2006-10-30 01:18:24 98,816 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1037.dll + 2006-10-30 01:18:30 102,400 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1038.dll + 2006-10-30 01:18:36 101,376 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1040.dll + 2006-10-30 01:18:42 98,816 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1041.dll + 2006-10-30 01:18:50 98,816 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1042.dll + 2006-10-30 01:18:56 99,840 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1043.dll + 2006-10-30 01:19:02 98,816 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1044.dll + 2006-10-30 01:19:08 99,840 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1045.dll + 2006-10-30 01:19:16 99,328 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1046.dll + 2006-10-30 01:19:28 98,816 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1049.dll + 2006-10-30 01:19:36 98,816 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1053.dll + 2006-10-30 01:19:42 98,816 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1055.dll + 2006-10-30 01:17:24 98,816 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.2052.dll + 2006-10-30 01:19:22 101,376 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.2070.dll + 2006-10-30 01:18:04 102,400 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.3082.dll + 2006-10-29 21:18:36 98,816 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.dll + 2006-10-29 21:19:30 1,103,872 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapUI.dll + 2006-10-30 01:34:02 172,032 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe + 2006-10-30 01:33:58 741,376 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe + 2008-07-30 22:26:24 626,440 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\install.exe + 2008-07-30 22:26:24 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\install.res.1033.dll + 2006-10-30 01:34:00 352,256 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.dll + 2006-10-30 01:34:00 151,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.Dtc.dll + 2006-10-30 01:34:02 2,560 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelEvents.dll + 2006-10-30 01:34:02 73,728 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe + 2006-10-30 01:34:02 11,264 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceMonikerSupport.dll + 2006-10-30 01:34:00 94,208 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMDiagnostics.dll + 2006-10-30 01:34:02 135,168 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe + 2006-10-30 01:34:02 884,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.Runtime.Serialization.dll + 2006-10-30 01:34:02 5,623,808 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.dll + 2006-10-30 01:34:00 159,744 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.Install.dll + 2006-10-30 01:34:00 16,384 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.WasHosting.dll + 2006-10-30 01:34:02 155,648 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe + 2006-07-25 19:32:00 14,648 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe + 2006-10-20 14:08:52 797,696 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\NaturalLanguage6.dll + 2006-10-20 14:09:02 4,874,240 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\NlsData0009.dll + 2006-10-20 12:03:40 2,628,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\NlsLexicons0009.dll + 2006-10-20 19:29:46 72,992 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PenIMC.dll + 2006-10-20 19:21:24 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationCFFRasterizer.dll + 2006-10-20 19:21:24 49,152 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe + 2006-10-20 19:29:52 106,272 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationHostDLL.dll + 2006-10-20 19:21:26 897,024 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationUI.dll + 2006-10-20 19:21:26 14,848 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe - 2004-08-03 22:44:22 768,512 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe + 2004-08-03 22:44:22 813,056 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe - 2001-10-26 15:29:54 99,840 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.exe + 2001-10-26 15:29:54 111,104 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.exe - 2004-08-03 22:44:22 743,936 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe + 2004-08-03 22:44:22 755,200 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe - 2003-07-16 14:50:50 55,296 ----a-w C:\WINDOWS\SOUNDMAN.EXE + 2003-07-16 14:50:50 132,096 ----a-w C:\WINDOWS\SOUNDMAN.EXE - 2004-08-03 22:44:18 187,904 ----a-w C:\WINDOWS\system32\accwiz.exe + 2004-08-03 22:44:18 199,168 ----a-w C:\WINDOWS\system32\accwiz.exe - 2001-10-26 15:29:48 115,200 ----a-w C:\WINDOWS\system32\calc.exe + 2001-10-26 15:29:48 126,464 ----a-w C:\WINDOWS\system32\calc.exe - 2001-10-26 15:29:48 80,896 ----a-w C:\WINDOWS\system32\charmap.exe + 2001-10-26 15:29:48 92,160 ----a-w C:\WINDOWS\system32\charmap.exe - 2004-08-03 22:44:18 65,024 ----a-w C:\WINDOWS\system32\cleanmgr.exe + 2004-08-03 22:44:18 76,288 ----a-w C:\WINDOWS\system32\cleanmgr.exe - 2004-08-03 22:44:18 395,776 ----a-w C:\WINDOWS\system32\cmd.exe + 2004-08-03 22:44:18 407,040 ----a-w C:\WINDOWS\system32\cmd.exe - 2001-10-26 15:29:50 15,872 ----a-w C:\WINDOWS\system32\comp.exe + 2001-10-26 15:29:50 59,904 ----a-w C:\WINDOWS\system32\comp.exe - 2001-10-26 15:29:50 17,920 ----a-w C:\WINDOWS\system32\compact.exe + 2001-10-26 15:29:50 61,952 ----a-w C:\WINDOWS\system32\compact.exe - 2008-07-29 12:33:44 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-08-05 17:57:24 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-07-29 12:33:44 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2008-08-05 17:57:24 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2008-08-05 01:37:57 8,790 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\FJNXV8OA\wr[1].exe - 2008-07-29 12:33:44 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat + 2008-08-05 17:57:24 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat + 2008-08-04 10:43:02 8,790 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\JKO1KXJT\wr[1].exe + 2008-08-04 17:13:39 8,790 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\JKO1KXJT\wr[2].exe + 2008-08-01 16:12:27 118,272 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\JWZCIIDD\pa[1].exe + 2008-08-07 20:36:39 8,790 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\P1TOXQN8\wr[1].exe - 2001-10-26 15:29:50 8,192 ----a-w C:\WINDOWS\system32\control.exe + 2001-10-26 15:29:50 52,224 ----a-w C:\WINDOWS\system32\control.exe + 2006-10-14 14:43:18 27,648 -c----w C:\WINDOWS\system32\dllcache\FilterPipelinePrintProc.dll + 2006-10-14 14:44:44 671,744 -c----w C:\WINDOWS\system32\dllcache\PrintFilterPipelineSvc.exe + 2006-10-14 18:21:58 580,352 -c----w C:\WINDOWS\system32\dllcache\XPSSHHDR.dll + 2006-10-14 18:22:00 1,698,048 -c----w C:\WINDOWS\system32\dllcache\XpsSvcs.dll + 2004-08-03 21:08:48 26,496 ----a-w C:\WINDOWS\system32\drivers\USBSTOR.SYS - 2001-10-26 15:29:52 47,104 ----a-w C:\WINDOWS\system32\drwtsn32.exe + 2001-10-26 15:29:52 58,368 ----a-w C:\WINDOWS\system32\drwtsn32.exe - 2004-08-03 22:44:20 180,224 ----a-w C:\WINDOWS\system32\dwwin.exe + 2004-08-03 22:44:20 225,280 ----a-w C:\WINDOWS\system32\dwwin.exe + 2006-10-20 19:29:46 69,408 ----a-w C:\WINDOWS\system32\dxva2.dll + 2006-10-20 19:30:00 478,496 ----a-w C:\WINDOWS\system32\evr.dll - 2008-07-29 12:33:19 95,072 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2008-07-31 08:19:46 98,256 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT - 2001-10-26 15:29:54 55,808 ----a-w C:\WINDOWS\system32\freecell.exe + 2001-10-26 15:29:54 198,144 ----a-w C:\WINDOWS\system32\freecell.exe - 2006-01-11 15:28:14 57,344 ----a-w C:\WINDOWS\system32\FTCOMModule\FTCOMModule.exe + 2006-01-11 15:28:14 69,632 ----a-w C:\WINDOWS\system32\FTCOMModule\FTCOMModule.exe + 2006-10-30 01:33:58 556,296 ----a-w C:\WINDOWS\system32\icardagt.exe + 2006-10-30 01:33:58 9,480 ----a-w C:\WINDOWS\system32\icardres.dll - 2004-08-03 22:44:22 34,304 ----a-w C:\WINDOWS\system32\ie4uinit.exe + 2004-08-03 22:44:22 45,568 ----a-w C:\WINDOWS\system32\ie4uinit.exe - 2004-08-03 22:44:22 150,016 ----a-w C:\WINDOWS\system32\imapi.exe + 2004-08-03 22:44:22 161,280 ----a-w C:\WINDOWS\system32\imapi.exe + 2006-10-30 01:33:58 83,968 ----a-w C:\WINDOWS\system32\infocardapi.dll - 2004-08-03 22:44:22 515,072 ----a-w C:\WINDOWS\system32\logonui.exe + 2004-08-03 22:44:22 526,336 ----a-w C:\WINDOWS\system32\logonui.exe - 2004-08-03 22:44:22 73,216 ----a-w C:\WINDOWS\system32\magnify.exe + 2004-08-03 22:44:22 183,296 ----a-w C:\WINDOWS\system32\magnify.exe + 2006-10-20 19:30:06 1,980,704 ----a-w C:\WINDOWS\system32\milcore.dll - 2004-08-03 22:44:22 143,872 ----a-w C:\WINDOWS\system32\mobsync.exe + 2004-08-03 22:44:22 188,416 ----a-w C:\WINDOWS\system32\mobsync.exe - 2001-10-26 15:29:58 128,000 ----a-w C:\WINDOWS\system32\mshearts.exe + 2001-10-26 15:29:58 171,520 ----a-w C:\WINDOWS\system32\mshearts.exe - 2004-08-03 22:44:26 345,088 ----a-w C:\WINDOWS\system32\mspaint.exe + 2004-08-03 22:44:26 422,400 ----a-w C:\WINDOWS\system32\mspaint.exe - 2004-08-03 22:33:18 408,576 ----a-w C:\WINDOWS\system32\mstsc.exe + 2004-08-03 22:33:18 452,608 ----a-w C:\WINDOWS\system32\mstsc.exe + 2006-09-01 10:08:02 1,334,032 ----a-w C:\WINDOWS\system32\msxml6.dll + 2006-07-19 08:55:18 86,728 ----a-w C:\WINDOWS\system32\msxml6r.dll - 2004-08-03 22:44:26 70,144 ----a-w C:\WINDOWS\system32\notepad.exe + 2004-08-03 22:44:26 81,408 ----a-w C:\WINDOWS\system32\notepad.exe - 2004-08-03 22:44:26 1,221,632 ----a-w C:\WINDOWS\system32\ntbackup.exe + 2004-08-03 22:44:26 1,232,896 ----a-w C:\WINDOWS\system32\ntbackup.exe - 2004-08-03 22:44:26 32,768 ----a-w C:\WINDOWS\system32\odbcad32.exe + 2004-08-03 22:44:26 45,056 ----a-w C:\WINDOWS\system32\odbcad32.exe - 2004-08-03 22:44:26 216,064 ----a-w C:\WINDOWS\system32\osk.exe + 2004-08-03 22:44:26 293,376 ----a-w C:\WINDOWS\system32\osk.exe - 2008-07-29 12:11:30 58,732 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-07-30 22:42:27 66,512 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-07-29 12:11:30 74,450 ----a-w C:\WINDOWS\system32\perfc015.dat + 2008-07-30 22:42:27 82,230 ----a-w C:\WINDOWS\system32\perfc015.dat - 2008-07-29 12:11:30 392,432 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-07-30 22:42:27 427,728 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-07-29 12:11:30 448,348 ----a-w C:\WINDOWS\system32\perfh015.dat + 2008-07-30 22:42:27 484,978 ----a-w C:\WINDOWS\system32\perfh015.dat + 2006-10-24 10:30:20 412,160 ------w C:\WINDOWS\system32\photometadatahandler.dll + 2006-10-20 19:29:52 104,224 ----a-w C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll + 2006-10-20 19:29:58 344,352 ----a-w C:\WINDOWS\system32\PresentationHost.exe + 2006-10-20 19:29:46 20,768 ----a-w C:\WINDOWS\system32\PresentationHostProxy.dll + 2006-10-20 19:30:02 769,312 ----a-w C:\WINDOWS\system32\PresentationNative_v0300.dll + 2006-10-14 14:43:38 124,416 ------w C:\WINDOWS\system32\prntvpt.dll - 2001-10-26 15:30:00 11,776 ----a-w C:\WINDOWS\system32\rasautou.exe + 2001-10-26 15:30:00 23,040 ----a-w C:\WINDOWS\system32\rasautou.exe - 2001-10-26 15:30:00 11,776 ----a-w C:\WINDOWS\system32\rasdial.exe + 2001-10-26 15:30:00 23,040 ----a-w C:\WINDOWS\system32\rasdial.exe - 2004-08-03 22:44:26 35,840 ----a-w C:\WINDOWS\system32\rcimlby.exe + 2004-08-03 22:44:26 79,872 ----a-w C:\WINDOWS\system32\rcimlby.exe - 2004-08-03 22:44:26 67,072 ----a-w C:\WINDOWS\system32\rdshost.exe + 2004-08-03 22:44:26 78,336 ----a-w C:\WINDOWS\system32\rdshost.exe - 2004-08-03 22:44:28 382,976 ----a-w C:\WINDOWS\system32\Restore\rstrui.exe + 2004-08-03 22:44:28 459,776 ----a-w C:\WINDOWS\system32\Restore\rstrui.exe + 2006-08-24 14:15:06 150,808 ----a-w C:\WINDOWS\system32\rgb9rast_2.dll - 2004-08-03 22:44:28 33,280 ----a-w C:\WINDOWS\system32\rundll32.exe + 2004-08-03 22:44:28 77,312 ----a-w C:\WINDOWS\system32\rundll32.exe - 2004-08-03 22:44:28 132,608 ----a-w C:\WINDOWS\system32\sndrec32.exe + 2004-08-03 22:44:28 143,872 ----a-w C:\WINDOWS\system32\sndrec32.exe - 2001-10-26 15:30:02 139,264 ----a-w C:\WINDOWS\system32\sndvol32.exe + 2001-10-26 15:30:02 183,296 ----a-w C:\WINDOWS\system32\sndvol32.exe - 2001-10-26 15:30:02 57,344 ----a-w C:\WINDOWS\system32\sol.exe + 2001-10-26 15:30:02 68,096 ----a-w C:\WINDOWS\system32\sol.exe - 2004-08-03 22:44:28 539,136 ----a-w C:\WINDOWS\system32\spider.exe + 2004-08-03 22:44:28 714,240 ----a-w C:\WINDOWS\system32\spider.exe - 2004-08-03 20:59:36 12,800 ----a-w C:\WINDOWS\system32\spiisupd.exe + 2004-08-03 20:59:36 56,832 ----a-w C:\WINDOWS\system32\spiisupd.exe - 2004-07-17 20:57:02 9,216 ------w C:\WINDOWS\system32\spmsg.dll + 2006-10-16 14:10:58 14,640 ------w C:\WINDOWS\system32\spmsg.dll + 2006-10-14 14:43:18 751,104 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdrv.dll + 2006-10-14 14:42:40 131,584 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll + 2006-10-14 14:42:18 376,320 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrv.dll + 2006-10-14 14:42:28 510,464 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrvui.dll + 2006-10-14 14:40:36 619,008 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll + 2006-10-14 18:22:00 1,698,048 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\XpsSvcs.dll + 2006-10-14 14:43:18 27,648 ----a-w C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll + 2006-10-14 14:44:44 671,744 ------w C:\WINDOWS\system32\spool\prtprocs\w32x86\PrintFilterPipelineSvc.exe + 2006-10-14 15:13:02 34,304 ----a-w C:\WINDOWS\system32\spool\prtprocs\x64\filterpipelineprintproc.dll + 2006-10-14 15:12:14 737,792 ----a-w C:\WINDOWS\system32\spool\XPSEP\amd64\amd64\mxdwdrv.dll + 2006-10-14 18:09:04 2,946,304 ----a-w C:\WINDOWS\system32\spool\XPSEP\amd64\amd64\xpssvcs.dll + 2006-10-14 15:12:14 737,792 ----a-w C:\WINDOWS\system32\spool\XPSEP\amd64\mxdwdrv.dll + 2006-10-14 18:09:04 2,946,304 ----a-w C:\WINDOWS\system32\spool\XPSEP\amd64\xpssvcs.dll + 2006-10-14 14:43:18 751,104 ----a-w C:\WINDOWS\system32\spool\XPSEP\i386\i386\mxdwdrv.dll + 2006-10-14 18:22:00 1,698,048 ----a-w C:\WINDOWS\system32\spool\XPSEP\i386\i386\xpssvcs.dll + 2006-10-14 14:43:18 751,104 ----a-w C:\WINDOWS\system32\spool\XPSEP\i386\mxdwdrv.dll + 2006-10-14 18:22:00 1,698,048 ----a-w C:\WINDOWS\system32\spool\XPSEP\i386\xpssvcs.dll - 2004-08-03 22:44:28 139,776 ----a-w C:\WINDOWS\system32\taskmgr.exe + 2004-08-03 22:44:28 183,808 ----a-w C:\WINDOWS\system32\taskmgr.exe - 2004-08-03 22:44:28 347,136 ----a-w C:\WINDOWS\system32\tourstart.exe + 2004-08-03 22:44:28 391,680 ----a-w C:\WINDOWS\system32\tourstart.exe + 2006-10-20 19:29:54 159,008 ----a-w C:\WINDOWS\system32\UIAutomationCore.dll - 2004-08-03 22:44:30 25,088 ----a-w C:\WINDOWS\system32\userinit.exe + 2004-08-03 22:44:30 36,352 ----a-w C:\WINDOWS\system32\userinit.exe - 2004-08-03 22:44:22 242,688 ----a-w C:\WINDOWS\system32\usmt\migwiz.exe + 2004-08-03 22:44:22 253,952 ----a-w C:\WINDOWS\system32\usmt\migwiz.exe - 2004-08-03 22:44:30 50,176 ----a-w C:\WINDOWS\system32\utilman.exe + 2004-08-03 22:44:30 61,440 ----a-w C:\WINDOWS\system32\utilman.exe - 2001-10-26 15:30:04 33,792 ----a-w C:\WINDOWS\system32\vssadmin.exe + 2001-10-26 15:30:04 45,056 ----a-w C:\WINDOWS\system32\vssadmin.exe + 2006-10-24 10:30:06 716,288 ------w C:\WINDOWS\system32\WindowsCodecs.dll + 2006-10-24 10:29:50 352,256 ------w C:\WINDOWS\system32\WindowsCodecsExt.dll - 2001-10-26 15:30:06 119,808 ----a-w C:\WINDOWS\system32\winmine.exe + 2001-10-26 15:30:06 164,352 ----a-w C:\WINDOWS\system32\winmine.exe + 2006-10-24 10:30:00 276,992 ------w C:\WINDOWS\system32\WMPhoto.dll - 2004-08-03 22:44:30 13,824 ----a-w C:\WINDOWS\system32\wscntfy.exe + 2004-08-03 22:44:30 123,392 ----a-w C:\WINDOWS\system32\wscntfy.exe - 2004-08-03 22:44:30 112,128 ----a-w C:\WINDOWS\system32\wuauclt.exe + 2004-08-03 22:44:30 156,160 ----a-w C:\WINDOWS\system32\wuauclt.exe - 2001-10-26 15:30:06 32,256 ----a-w C:\WINDOWS\system32\wupdmgr.exe + 2001-10-26 15:30:06 43,520 ----a-w C:\WINDOWS\system32\wupdmgr.exe + 2006-10-14 18:21:58 580,352 ------w C:\WINDOWS\system32\XPSSHHDR.dll + 2006-10-14 18:22:00 1,698,048 ------w C:\WINDOWS\system32\XpsSvcs.dll + 2006-10-20 19:29:54 304,928 ----a-w C:\WINDOWS\system32\XPSViewer\XPSViewer.exe - 2004-08-03 22:44:30 285,696 ----a-w C:\WINDOWS\winhlp32.exe + 2004-08-03 22:44:30 329,728 ----a-w C:\WINDOWS\winhlp32.exe . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36 2111176] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2003-12-12 23:50 33792] "OBSWATCH"="C:\PROGRA~1\OrangeBs\Watch.exe" [2005-09-07 10:26 65536] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "runner1"="C:\WINDOWS\mrofinu1001186.exe" [2008-08-07 23:02 44544] "SoundMan"="SOUNDMAN.EXE" [2003-07-16 16:50 132096 C:\WINDOWS\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= R3 GTFFBUS;GT FF BUS;C:\WINDOWS\system32\DRIVERS\gtffbus.sys [2006-05-29 10:52] R3 GTMMDMUSB;GT M 3G+ USB MDM;C:\WINDOWS\system32\DRIVERS\gtmmdmusb.sys [2006-05-29 10:52] R3 GTMSERUSB;GT M 3G+ USB SER;C:\WINDOWS\system32\DRIVERS\gtmserusb.sys [2006-05-29 10:52] R3 GTPTSER;GT PT SER;C:\WINDOWS\system32\DRIVERS\gtptser.sys [2006-05-29 10:52] R3 GTSCSER;GT SC SER;C:\WINDOWS\system32\DRIVERS\gtscser.sys [2006-05-29 10:52] R3 NTProcDrv;Process creation detector for NT.;D:\Silkroad\Bot\NtProcDrv.sys [2005-02-24 06:08] S3 GTMNDISIRPXP;GT M 3G+ IRP NDIS;C:\WINDOWS\system32\DRIVERS\Gtm51Irp.sys [2006-05-29 10:52] S3 GtVUsb;GlobeTrotter 3G+ Viper Filter Service;C:\WINDOWS\system32\DRIVERS\GtVUsb.sys [2006-05-29 10:52] . . ------- Supplementary Scan ------- . O17 -: HKLM\CCS\Interface\{EFCD692F-8B96-460D-9EA0-44A4791426AA}: NameServer = 217.116.100.66 217.116.100.65 ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-07 23:02:16 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-07 23:03:34 ComboFix-quarantined-files.txt 2008-08-07 21:03:31 ComboFix2.txt 2008-07-30 15:17:05 Pre-Run: 5,356,908,544 bajtów wolnych Post-Run: 5,365,526,528 bajtów wolnych 454

**Posty:** 7956 · przez **Magik** 07 Sie 2008, 23:16

No i masz konkret w systemie, mnostwo zarazonych exe'kow

Virus / Rootkit VT100.EXE

# ukrywa swój proces i plik wykonywalny

# wstrzykuje kod do każdego uruchomionego procesu

# infekuje wiekszość plików wykonywalnych na wszystkich dyskach, zwiękaszjąc ich rozmiar o 5120 lub 8192 bajty

# jeżeli plik nie był zainfekowany, zostaje zmodyfikowany w momencie uruchomienia ( u mnie *.EXE, *.SCR )

# zainfekowany plik łączy się z komputerm w sieci, próbując załadować plik rootkit'a VT100.EXE

# po załadowaniu i uruchomieniu VT100.EXE, następuje masowa infekcja plików *.EXE

# Kaspersky posiada już procedure leczenia zainfekowanych plików

Operacja leczenia kompa

do tego odpal
Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt +

programy-szukajace-i-usuwajace-rootkity-vt99453.html