Niepokojący raport z AVG anty spyware + logi

[Electra (Noobenstein)]

Witam, dziś rano odpaliłem AVG anty spyware i zapuściłem full skana, wynik mnie zaskoczył. Otóż było 5 elementów “high risk” w system volume information i folderze C:\Documents and Settings\Electra\Dane aplikacji\Mozilla\Firefox\Profiles. Nie wiem jak infekcja dostała się do komputera podejrzewam, że z ściągniętym programem. AVG usunął zainfekowane pliki lecz po takim robalu i tak prosiłbym o sprawdzenie logów przez eksperta. Oto logi:

Logfile of HijackThis v1.99.1 Scan saved at 17:35:54, on 2006-12-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\SOUNDMAN.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Documents and Settings\Electra\Pulpit\tools\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.allegro.pl/show_item.php?item=138745848 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU…\Run: [sMSystemAnalyzer] “C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe” O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip…{0F5C5D51-7628-4222-9D75-B0681BB770C5}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip…{0F5C5D51-7628-4222-9D75-B0681BB770C5}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS2\Services\Tcpip…{0F5C5D51-7628-4222-9D75-B0681BB770C5}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “SMSystemAnalyzer” = ““C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe”” [“iolo technologies, LLC”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”] “AVG7_CC” = “C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP” [“GRISOFT, s.r.o.”] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup” [MS] “nwiz” = “nwiz.exe /install” [“NVIDIA Corporation”] “NvMediaCenter” = “RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit” [MS] HKLM\Software\Microsoft\Active Setup\Installed Components\ >{26923b43-4d38-484f-9b9e-de460746276c}(Default) = “Internet Explorer” \StubPath = “C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE” [MS] >{881dd1c5-3dcf-431b-b061-f3f88e8be88a}(Default) = “Outlook Express” \StubPath = “C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}” = “AVG7 Shell Extension” -> {HKLM…CLSID} = “AVG7 Shell Extension Class” \InProcServer32(Default) = “C:\Program Files\Grisoft\AVG Free\avgse.dll” [“GRISOFT, s.r.o.”] “{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}” = “AVG7 Find Extension” -> {HKLM…CLSID} = “AVG7 Find Extension Class” \InProcServer32(Default) = “C:\Program Files\Grisoft\AVG Free\avgse.dll” [“GRISOFT, s.r.o.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{32020A01-506E-484D-A2A8-BE3CF17601C3}” = “AlcoholShellEx” -> {HKLM…CLSID} = “AlcoholShellEx” \InProcServer32(Default) = “C:\PROGRA~1\ALCOHO~1\ALCOHO~1\axshlex.dll” [“Alcohol Soft Development Team”] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}” = “AVG Anti-Spyware 7.5” -> {HKLM…CLSID} = “CShellExecuteHookImpl Object” \InProcServer32(Default) = “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll” [“Anti-Malware Development a.s.”] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “WPDShServiceObj” = “{AAA288BA-9A4C-45B0-95D7-94D524869DB5}” -> {HKLM…CLSID} = “WPDShServiceObj Class” \InProcServer32(Default) = “C:\WINDOWS\system32\WPDShServiceObj.dll” [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ <> “BootExecute” = “autocheck autochk *”|“smrgdf C:\Program Files\iolo\System Mechanic Professional 6” [null data] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] AVG7 Shell Extension(Default) = “{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}” -> {HKLM…CLSID} = “AVG7 Shell Extension Class” \InProcServer32(Default) = “C:\Program Files\Grisoft\AVG Free\avgse.dll” [“GRISOFT, s.r.o.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ AVG7 Shell Extension(Default) = “{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}” -> {HKLM…CLSID} = “AVG7 Shell Extension Class” \InProcServer32(Default) = “C:\Program Files\Grisoft\AVG Free\avgse.dll” [“GRISOFT, s.r.o.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Default executables: -------------------- <> HKLM\Software\Classes\htafile\shell\open\command(Default) = “NOTEPAD.EXE %1” [MS] <> HKLM\Software\Classes\scrfile\shell\open\command(Default) = “NOTEPAD.EXE %1” [MS] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “DisableRegistryTools” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Electra\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Startup items in “Electra” & “All Users” startup folders: --------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “DSLMON” -> shortcut to: “C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe” [empty string] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe” [“Anti-Malware Development a.s.”] AVG E-mail Scanner, AVGEMS, “C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe” [“GRISOFT, s.r.o.”] AVG7 Alert Manager Server, Avg7Alrt, “C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe” [“GRISOFT, s.r.o.”] AVG7 Update Service, Avg7UpdSvc, “C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe” [“GRISOFT, s.r.o.”] HTTP SSL, HTTPFilter, “C:\WINDOWS\System32\svchost.exe -k HTTPFilter” {“C:\WINDOWS\System32\w3ssl.dll” [MS]} NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\system32\nvsvc32.exe” [“NVIDIA Corporation”] StarWind iSCSI Service, StarWindService, “C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe” [“Rocket Division Software”] Sunbelt Kerio Personal Firewall 4, KPF4, ““C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe”” [“Sunbelt Software”] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 30 seconds)

Electra - 06-12-26 17:39:20,89 Dodatek Service Pack 2 ComboFix 06.11.27 - Running from: “C:\Documents and Settings\Electra\Pulpit\tools” ((((((((((((((((((((((((((((((( Files Created from 2006-11-22 to 2006-12-22 )))))))))))))))))))))))))))))))))) 2006-12-23 23:24 2006-12-23 23:14 2006-12-22 21:59 17,920 --a------ C:\WINDOWS\system32\mdimon.dll 2006-12-22 21:59 2006-12-22 21:58 2006-12-22 21:58 2006-12-22 21:56 2006-12-22 21:51 2006-12-22 21:51 2006-12-22 21:51 2006-12-22 21:50 2006-12-22 01:22 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2006-12-22 00:24 3,968 --a------ C:\WINDOWS\system32\drivers\avgclean.sys 2006-12-22 00:24 18,240 --a------ C:\WINDOWS\system32\drivers\avgmfx86.sys 2006-12-21 23:54 299,008 --a------ C:\WINDOWS\uninst.exe 2006-12-21 14:58 314,880 --a------ C:\WINDOWS\IsUninst.exe 2006-12-21 14:57 2006-12-17 00:16 2006-12-14 17:49 2006-12-14 17:48 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2006-12-14 17:48 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2006-12-14 17:48 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2006-12-14 17:48 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2006-12-14 17:48 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2006-12-14 17:48 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2006-12-14 17:48 2006-12-14 08:49 2006-12-13 23:22 2006-12-13 19:36 2006-12-13 19:36 2006-12-13 19:34 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys 2006-12-13 19:32 2006-12-13 18:50 2006-12-13 15:42 2006-12-13 15:22 2006-12-13 15:10 2006-12-13 15:07 2006-12-13 15:06 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2006-12-13 15:06 2006-12-13 15:06 2006-12-13 15:04 46,080 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2006-12-13 15:04 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2006-12-13 15:04 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2006-12-13 15:04 2006-12-13 15:03 2006-12-13 15:01 774,144 --a------ C:\WINDOWS\system32\vsfilter.dll 2006-12-13 15:01 77,824 --a------ C:\WINDOWS\system32\vorbisfile.dll 2006-12-13 15:01 77,824 --a------ C:\WINDOWS\system32\mplaw7.dll 2006-12-13 15:01 77,824 --a------ C:\WINDOWS\system32\mplaa6.dll 2006-12-13 15:01 75,264 --a------ C:\WINDOWS\system32\MACDec.dll 2006-12-13 15:01 679,936 --a------ C:\WINDOWS\system32\xvidcore.dll 2006-12-13 15:01 65,536 --a------ C:\WINDOWS\system32\mplapx.dll 2006-12-13 15:01 65,536 --a------ C:\WINDOWS\system32\mplam6.dll 2006-12-13 15:01 61,440 --a------ C:\WINDOWS\system32\ogg.dll 2006-12-13 15:01 61,440 --a------ C:\WINDOWS\system32\libfaac.dll 2006-12-13 15:01 507,904 --a------ C:\WINDOWS\system32\mcmpgdec.dll 2006-12-13 15:01 446,464 --a------ C:\WINDOWS\system32\vp31vfw.dll 2006-12-13 15:01 438,272 --a------ C:\WINDOWS\system32\vp6vfw.dll 2006-12-13 15:01 421,888 --a------ C:\WINDOWS\system32\OpenQuicktimeLib.dll 2006-12-13 15:01 413,760 --a------ C:\WINDOWS\system32\mpg4c32.dll 2006-12-13 15:01 413,760 --a------ C:\WINDOWS\system32\DivXc32f.dll 2006-12-13 15:01 413,760 --a------ C:\WINDOWS\system32\DivXc32.dll 2006-12-13 15:01 39,936 --a------ C:\WINDOWS\system32\huffyuv.dll 2006-12-13 15:01 368,640 --a------ C:\WINDOWS\system32\vobsub.dll 2006-12-13 15:01 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll 2006-12-13 15:01 286,720 --a------ C:\WINDOWS\system32\3ivxVfWCodec.dll 2006-12-13 15:01 245,408 --a------ C:\WINDOWS\system32\unicows.dll 2006-12-13 15:01 237,568 --a------ C:\WINDOWS\system32\OggDS.dll 2006-12-13 15:01 237,568 --a------ C:\WINDOWS\system32\mpegin.dll 2006-12-13 15:01 2,024,448 --a------ C:\WINDOWS\system32\divx.dll 2006-12-13 15:01 19,968 --a------ C:\WINDOWS\system32\cpuinf32.dll 2006-12-13 15:01 157,696 --a------ C:\WINDOWS\system32\unrar.dll 2006-12-13 15:01 155,648 --a------ C:\WINDOWS\system32\xvidvfw.dll 2006-12-13 15:01 1,650,688 --a------ C:\WINDOWS\system32\mplva6.dll 2006-12-13 15:01 1,581,056 --a------ C:\WINDOWS\system32\mplvw7.dll 2006-12-13 15:01 1,552,384 --a------ C:\WINDOWS\system32\mplvm6.dll 2006-12-13 15:01 1,415,680 --a------ C:\WINDOWS\system32\WMV9VCM.dll 2006-12-13 15:01 1,163,264 --a------ C:\WINDOWS\system32\vorbis.dll 2006-12-13 15:01 1,122,304 --a------ C:\WINDOWS\system32\mplvpx.dll 2006-12-13 15:01 1,040,384 --a------ C:\WINDOWS\system32\vorbisenc.dll 2006-12-13 15:01 1,024,000 --a------ C:\WINDOWS\system32\3ivx.dll 2006-12-13 15:01 2006-12-13 15:01 2006-12-13 15:01 2006-12-13 14:59 107,134 --a------ C:\WINDOWS\UninstallFirefox.exe 2006-12-13 14:59 2006-12-13 14:59 2006-12-13 14:58 2006-12-13 14:57 2006-12-13 14:56 2006-12-13 14:56 2006-12-13 14:55 2006-12-13 14:54 2006-12-13 14:53 223,128 --a------ C:\WINDOWS\system32\drivers\vaxscsi.sys 2006-12-13 14:53 2006-12-13 14:52 96,256 --a------ C:\WINDOWS\system32\drivers\sptd0829.sys 2006-12-13 14:52 642,560 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2006-12-13 10:54 2006-12-13 10:52 816,672 --a------ C:\WINDOWS\system32\drivers\avg7core.sys 2006-12-13 10:52 4,224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys 2006-12-13 10:52 28,416 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys 2006-12-13 10:49 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2006-12-13 10:48 77,312 --a------ C:\WINDOWS\system32\usbui.dll 2006-12-13 10:48 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2006-12-13 10:46 9,936 --a------ C:\WINDOWS\system\LZEXPAND.DLL 2006-12-13 10:46 9,341 --a------ C:\WINDOWS\system32\drivers\filedisk.sys 2006-12-13 10:46 9,168 --a------ C:\WINDOWS\system\VER.DLL 2006-12-13 10:46 85,532 --a------ C:\WINDOWS\system32\dgsetup.dll 2006-12-13 10:46 83,456 --a------ C:\WINDOWS\system\OLECLI.DLL 2006-12-13 10:46 8,704 --a------ C:\WINDOWS\system32\batt.dll 2006-12-13 10:46 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll 2006-12-13 10:46 75,776 --a------ C:\WINDOWS\system32\storprop.dll 2006-12-13 10:46 70,144 --a------ C:\WINDOWS\NOTEPAD.EXE 2006-12-13 10:46 70,096 --a------ C:\WINDOWS\system\AVICAP.DLL 2006-12-13 10:46 7,168 --a------ C:\WINDOWS\system32\kbdcz.dll 2006-12-13 10:46 69,552 --a------ C:\WINDOWS\system\MMSYSTEM.DLL 2006-12-13 10:46 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll 2006-12-13 10:46 6,656 --a------ C:\WINDOWS\system32\kbdycl.dll 2006-12-13 10:46 6,656 --a------ C:\WINDOWS\system32\kbdsl1.dll 2006-12-13 10:46 6,656 --a------ C:\WINDOWS\system32\kbdsl.dll 2006-12-13 10:46 6,656 --a------ C:\WINDOWS\system32\kbdhu.dll 2006-12-13 10:46 6,656 --a------ C:\WINDOWS\system32\kbdcz2.dll 2006-12-13 10:46 6,656 --a------ C:\WINDOWS\system32\kbdcz1.dll 2006-12-13 10:46 6,656 --a------ C:\WINDOWS\system32\kbdcr.dll 2006-12-13 10:46 6,656 --a------ C:\WINDOWS\system32\KBDAL.DLL 2006-12-13 10:46 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll 2006-12-13 10:46 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll 2006-12-13 10:46 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll 2006-12-13 10:46 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll 2006-12-13 10:46 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll 2006-12-13 10:46 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll 2006-12-13 10:46 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbdycc.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbduzb.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbdur.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbdtat.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbdru1.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbdru.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbdkaz.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbdbu.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbdblr.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll 2006-12-13 10:46 5,632 -ra------ C:\WINDOWS\system32\kbdaze.dll 2006-12-13 10:46 5,632 --a------ C:\WINDOWS\system32\kbdro.dll 2006-12-13 10:46 5,632 --a------ C:\WINDOWS\system32\kbdhu1.dll 2006-12-13 10:46 5,120 --a------ C:\WINDOWS\system\SHELL.DLL 2006-12-13 10:46 41,472 --a------ C:\WINDOWS\system32\iolobtdfg.exe 2006-12-13 10:46 33,376 --a------ C:\WINDOWS\system\COMMDLG.DLL 2006-12-13 10:46 25,264 --a------ C:\WINDOWS\system32\smrgdf.exe 2006-12-13 10:46 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll 2006-12-13 10:46 24,064 --a------ C:\WINDOWS\system\OLESVR.DLL 2006-12-13 10:46 19,200 --a------ C:\WINDOWS\system\TAPI.DLL 2006-12-13 10:46 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll 2006-12-13 10:46 15,360 --a------ C:\WINDOWS\TASKMAN.EXE 2006-12-13 10:46 13,312 --a------ C:\WINDOWS\system32\irclass.dll 2006-12-13 10:46 127,008 --a------ C:\WINDOWS\system\MSVIDEO.DLL 2006-12-13 10:46 11,264 --a------ C:\WINDOWS\system32\drivers\irenum.sys 2006-12-13 10:46 109,488 --a------ C:\WINDOWS\system\AVIFILE.DLL 2006-12-13 10:46 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll 2006-12-13 10:46 1,212,416 --a------ C:\WINDOWS\system32\Incinerator.dll 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:46 2006-12-13 10:45 2006-12-13 10:45 2006-12-13 10:45 2006-12-13 10:44 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2006-12-13 10:44 4,960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys 2006-12-13 10:44 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2006-12-13 10:44 2006-12-13 10:44 2006-12-13 10:44 2006-12-13 10:44 2006-12-13 10:44 2006-12-13 10:41 49,152 --a------ C:\WINDOWS\system32\ChCfg.exe 2006-12-13 10:41 46,892 --a------ C:\WINDOWS\system32\adadix16.dll 2006-12-13 10:41 46,167 --a------ C:\WINDOWS\system32\drivers\adildr.sys 2006-12-13 10:41 4,981 --a------ C:\WINDOWS\system32\adadix2k.dll 2006-12-13 10:41 155,648 --a------ C:\WINDOWS\system32\adadix32.dll 2006-12-13 10:41 143,360 --a------ C:\WINDOWS\autoclk.exe 2006-12-13 10:41 135,168 --a------ C:\WINDOWS\system32\unaddrv.exe 2006-12-13 10:41 127,497 --a------ C:\WINDOWS\system32\drivers\adiusbaw.sys 2006-12-13 10:41 127,456 --a------ C:\WINDOWS\system32\ipdetect.exe 2006-12-13 10:41 126,976 --a------ C:\WINDOWS\system32\coclassfast.dll 2006-12-13 10:41 1,531,904 --a------ C:\WINDOWS\adiras.exe 2006-12-13 10:40 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys 2006-12-13 10:40 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys 2006-12-13 10:40 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys 2006-12-13 10:40 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys 2006-12-13 10:40 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys 2006-12-13 10:40 577,536 --a------ C:\WINDOWS\soundman.exe 2006-12-13 10:40 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys 2006-12-13 10:40 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys 2006-12-13 10:40 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2006-12-13 10:40 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys 2006-12-13 10:40 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2006-12-13 10:40 4,024,832 -ra------ C:\WINDOWS\system32\drivers\alcxwdm.sys 2006-12-13 10:40 315,392 --a------ C:\WINDOWS\alcupd.exe 2006-12-13 10:40 217,088 --a------ C:\WINDOWS\Alcrmv.exe 2006-12-13 10:40 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys 2006-12-13 10:40 172,416 --a------ C:\WINDOWS\system32\drivers\kmixer.sys 2006-12-13 10:40 147,456 --a------ C:\WINDOWS\system32\RtlCPAPI.dll 2006-12-13 10:40 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys 2006-12-13 10:40 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys 2006-12-13 10:40 10,528,768 --a------ C:\WINDOWS\system32\RTLCPL.exe 2006-12-13 10:40 2006-12-13 10:40 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:38 2006-12-13 10:37 2006-12-13 10:37 2006-12-13 10:37 2006-12-13 10:37 2006-12-13 10:37 2006-12-13 10:37 2006-12-13 10:37 2006-12-13 10:37 2006-12-13 10:37 2006-12-13 10:37 2006-12-13 10:37 2006-12-13 10:37 2006-12-13 10:37 2006-12-13 10:37 2006-12-13 10:37 2006-12-13 10:37 2006-12-13 10:37 2006-12-13 10:37 2006-12-13 10:29 26,496 --a------ C:\WINDOWS\system32\drivers\USBSTOR.SYS 2006-12-13 10:28 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe 2006-12-13 10:23 2006-12-13 10:23 2006-12-13 10:23 2006-12-13 10:20 208,896 --a------ C:\WINDOWS\system32\nvuide.exe 2006-12-13 10:19 208,896 --a------ C:\WINDOWS\system32\nvusmb.exe 2006-12-13 10:19 208,896 --a------ C:\WINDOWS\system32\nvunrm.exe 2006-12-13 10:19 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2006-12-13 10:19 208,896 --a------ C:\WINDOWS\system32\nvumctl.exe 2006-12-13 10:19 208,896 --a------ C:\WINDOWS\system32\nvugart.exe 2006-12-13 10:19 2006-12-13 10:18 2006-12-13 10:18 2006-12-13 10:17 2006-12-13 10:16 2006-12-13 10:16 2006-12-13 10:16 2006-12-13 09:57 0 -rahs---- C:\MSDOS.SYS 2006-12-13 09:57 0 -rahs---- C:\IO.SYS 2006-12-13 09:57 0 --a------ C:\CONFIG.SYS 2006-12-13 09:57 0 --a------ C:\AUTOEXEC.BAT 2006-12-13 09:57 2006-12-13 09:57 2006-12-13 09:57 2006-12-13 09:56 112,128 --a------ C:\WINDOWS\system32\mapi32.dll 2006-12-13 09:56 2006-12-13 09:55 11,264 --a------ C:\WINDOWS\system32\atrace.dll 2006-12-13 09:55 2006-12-13 09:55 2006-12-13 09:55 2006-12-13 09:55 2006-12-13 09:55 2006-12-13 09:54 86,016 --a------ C:\WINDOWS\system32\isign32.dll 2006-12-13 09:54 81,920 --a------ C:\WINDOWS\system32\ils.dll 2006-12-13 09:54 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll 2006-12-13 09:54 73,728 --a------ C:\WINDOWS\system32\icwdial.dll 2006-12-13 09:54 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys 2006-12-13 09:54 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll 2006-12-13 09:54 69,632 --a------ C:\WINDOWS\system32\msconf.dll 2006-12-13 09:54 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll 2006-12-13 09:54 67,584 --a------ C:\WINDOWS\system32\srclient.dll 2006-12-13 09:54 67,584 --a------ C:\WINDOWS\system32\acctres.dll 2006-12-13 09:54 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll 2006-12-13 09:54 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll 2006-12-13 09:54 49,664 --a------ C:\WINDOWS\system32\inetres.dll 2006-12-13 09:54 466,200 --a------ C:\WINDOWS\system32\wuapi.dll 2006-12-13 09:54 45,568 --a------ C:\WINDOWS\system32\safrslv.dll 2006-12-13 09:54 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll 2006-12-13 09:54 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll 2006-12-13 09:54 41,240 --a------ C:\WINDOWS\system32\wups.dll 2006-12-13 09:54 382,464 --a------ C:\WINDOWS\system32\qmgr.dll 2006-12-13 09:54 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll 2006-12-13 09:54 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe 2006-12-13 09:54 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll 2006-12-13 09:54 29,696 --a------ C:\WINDOWS\system32\safrdm.dll 2006-12-13 09:54 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll 2006-12-13 09:54 278,528 --a------ C:\WINDOWS\system32\mstask.dll 2006-12-13 09:54 278,528 --a------ C:\WINDOWS\system32\inetcfg.dll 2006-12-13 09:54 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll 2006-12-13 09:54 240,128 --a------ C:\WINDOWS\system32\srrstr.dll 2006-12-13 09:54 23,040 --a------ C:\WINDOWS\system32\fltmc.exe 2006-12-13 09:54 195,352 --a------ C:\WINDOWS\system32\wuaueng1.dll 2006-12-13 09:54 192,000 --a------ C:\WINDOWS\system32\schedsvc.dll 2006-12-13 09:54 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll 2006-12-13 09:54 175,384 --a------ C:\WINDOWS\system32\wuauclt1.exe 2006-12-13 09:54 173,536 --a------ C:\WINDOWS\system32\wuweb.dll 2006-12-13 09:54 171,008 --a------ C:\WINDOWS\system32\srsvc.dll 2006-12-13 09:54 16,896 --a------ C:\WINDOWS\system32\fltlib.dll 2006-12-13 09:54 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll 2006-12-13 09:54 128,896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys 2006-12-13 09:54 128,280 --a------ C:\WINDOWS\system32\wucltui.dll 2006-12-13 09:54 125,208 --a------ C:\WINDOWS\system32\wuauclt.exe 2006-12-13 09:54 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll 2006-12-13 09:54 12,288 --a------ C:\WINDOWS\system32\mstinit.exe 2006-12-13 09:54 105,984 --a------ C:\WINDOWS\system32\msoert2.dll 2006-12-13 09:54 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll 2006-12-13 09:54 2006-12-13 09:54 2006-12-13 09:54 2006-12-13 09:54 2006-12-13 09:54 2006-12-13 09:54 2006-12-13 09:54 2006-12-13 09:54 2006-12-13 09:54 2006-12-13 09:54 2006-12-13 09:54 2006-12-13 09:53 9,728 --a------ C:\WINDOWS\system32\reset.exe 2006-12-13 09:53 80,896 --a------ C:\WINDOWS\system32\charmap.exe 2006-12-13 09:53 73,216 --a------ C:\WINDOWS\system32\avwav.dll 2006-12-13 09:53 605,696 --a------ C:\WINDOWS\system32\getuname.dll 2006-12-13 09:53 57,344 --a------ C:\WINDOWS\system32\sol.exe 2006-12-13 09:53 55,808 --a------ C:\WINDOWS\system32\freecell.exe 2006-12-13 09:53 5,632 --a------ C:\WINDOWS\system32\write.exe 2006-12-13 09:53 44,544 --a------ C:\WINDOWS\system32\hticons.dll 2006-12-13 09:53 35,328 --a------ C:\WINDOWS\system32\winchat.exe 2006-12-13 09:53 231,424 --a------ C:\WINDOWS\system32\avtapi.dll 2006-12-13 09:53 17,920 --a------ C:\WINDOWS\system32\tsshutdn.exe 2006-12-13 09:53 16,384 --a------ C:\WINDOWS\system32\tskill.exe 2006-12-13 09:53 16,384 --a------ C:\WINDOWS\system32\avmeter.dll 2006-12-13 09:53 139,264 --a------ C:\WINDOWS\system32\sndvol32.exe 2006-12-13 09:53 128,000 --a------ C:\WINDOWS\system32\mshearts.exe 2006-12-13 09:53 119,808 --a------ C:\WINDOWS\system32\winmine.exe 2006-12-13 09:53 115,200 --a------ C:\WINDOWS\system32\calc.exe 2006-12-13 09:53 1,225 --a------ C:\WINDOWS\system32\usrlogon.cmd 2006-12-13 09:53 2006-12-13 09:53 2006-12-13 09:53 2006-12-13 09:53 2006-12-13 09:53 2006-12-13 09:52 97,792 --a------ C:\WINDOWS\system32\comrepl.dll 2006-12-13 09:52 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll 2006-12-13 09:52 94,720 --a------ C:\WINDOWS\system32\tscfgwmi.dll 2006-12-13 09:52 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll 2006-12-13 09:52 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll 2006-12-13 09:52 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll 2006-12-13 09:52 67,072 --a------ C:\WINDOWS\system32\rdshost.exe 2006-12-13 09:52 655,360 --a------ C:\WINDOWS\system32\mstscax.dll 2006-12-13 09:52 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll 2006-12-13 09:52 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe 2006-12-13 09:52 60,928 --a------ C:\WINDOWS\system32\remotepg.dll 2006-12-13 09:52 60,416 --a------ C:\WINDOWS\system32\colbact.dll 2006-12-13 09:52 6,144 --a------ C:\WINDOWS\system32\msdtc.exe 2006-12-13 09:52 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll 2006-12-13 09:52 58,880 --a------ C:\WINDOWS\system32\licwmi.dll 2006-12-13 09:52 56,320 --a------ C:\WINDOWS\system32\servdeps.dll 2006-12-13 09:52 540,160 --a------ C:\WINDOWS\system32\comuid.dll 2006-12-13 09:52 54,272 --a------ C:\WINDOWS\system32\stclient.dll 2006-12-13 09:52 539,136 --a------ C:\WINDOWS\system32\spider.exe 2006-12-13 09:52 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe 2006-12-13 09:52 498,688 --a------ C:\WINDOWS\system32\clbcatq.dll 2006-12-13 09:52 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe 2006-12-13 09:52 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll 2006-12-13 09:52 408,576 --a------ C:\WINDOWS\system32\mstsc.exe 2006-12-13 09:52 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys 2006-12-13 09:52 4,608 --a------ C:\WINDOWS\system32\rdpcfgex.dll 2006-12-13 09:52 4,096 --a------ C:\WINDOWS\system32\mtxex.dll 2006-12-13 09:52 38,912 --a------ C:\WINDOWS\system32\cfgbkend.dll 2006-12-13 09:52 351,744 --a------ C:\WINDOWS\system32\hypertrm.dll 2006-12-13 09:52 345,088 --a------ C:\WINDOWS\system32\mspaint.exe 2006-12-13 09:52 33,792 --a------ C:\WINDOWS\system32\regini.exe 2006-12-13 09:52 296,448 --a------ C:\WINDOWS\system32\termsrv.dll 2006-12-13 09:52 25,600 --a------ C:\WINDOWS\system32\comaddin.dll 2006-12-13 09:52 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll 2006-12-13 09:52 225,792 --a------ C:\WINDOWS\system32\catsrv.dll 2006-12-13 09:52 22,528 --a------ C:\WINDOWS\system32\qwinsta.exe 2006-12-13 09:52 22,528 --a------ C:\WINDOWS\system32\msg.exe 2006-12-13 09:52 21,896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys 2006-12-13 09:52 20,992 --a------ C:\WINDOWS\system32\qprocess.exe 2006-12-13 09:52 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll 2006-12-13 09:52 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys 2006-12-13 09:52 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll 2006-12-13 09:52 187,904 --a------ C:\WINDOWS\system32\cmprops.dll 2006-12-13 09:52 187,904 --a------ C:\WINDOWS\system32\accwiz.exe 2006-12-13 09:52 17,920 --a------ C:\WINDOWS\system32\mmfutil.dll 2006-12-13 09:52 17,408 --a------ C:\WINDOWS\system32\qappsrv.exe 2006-12-13 09:52 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll 2006-12-13 09:52 16,384 --a------ C:\WINDOWS\system32\rwinsta.exe 2006-12-13 09:52 15,872 --a------ C:\WINDOWS\system32\logoff.exe 2006-12-13 09:52 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll 2006-12-13 09:52 15,360 --a------ C:\WINDOWS\system32\tsdiscon.exe 2006-12-13 09:52 15,360 --a------ C:\WINDOWS\system32\tscon.exe 2006-12-13 09:52 15,360 --a------ C:\WINDOWS\system32\shadow.exe 2006-12-13 09:52 147,968 --a------ C:\WINDOWS\system32\rdchost.dll 2006-12-13 09:52 147,456 --a------ C:\WINDOWS\system32\comsnap.dll 2006-12-13 09:52 141,824 --a------ C:\WINDOWS\system32\sessmgr.exe 2006-12-13 09:52 139,528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys 2006-12-13 09:52 132,608 --a------ C:\WINDOWS\system32\sndrec32.exe 2006-12-13 09:52 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe 2006-12-13 09:52 124,928 --a------ C:\WINDOWS\system32\mplay32.exe 2006-12-13 09:52 12,040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys 2006-12-13 09:52 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll 2006-12-13 09:52 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll 2006-12-13 09:52 11,264 --a------ C:\WINDOWS\system32\icaapi.dll 2006-12-13 09:52 103,424 --a------ C:\WINDOWS\system32\clipbrd.exe 2006-12-13 09:52 1,267,200 --a------ C:\WINDOWS\system32\comsvcs.dll 2006-12-13 09:52 2006-12-13 09:52 2006-12-13 09:52 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “SMSystemAnalyzer”="“C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe”" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “SoundMan”=“SOUNDMAN.EXE” “AVG7_CC”=“C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP” “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” “NvCplDaemon”=“RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup” “nwiz”=“nwiz.exe /install” “NvMediaCenter”=“RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] “Installed”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] “Installed”=“1” “NoChange”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] “Installed”=“1” [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] “DeskHtmlVersion”=dword:00000110 “DeskHtmlMinorVersion”=dword:00000005 “Settings”=dword:00000001 “GeneralFlags”=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] “Source”=“About:Home” “SubscribedURL”=“About:Home” “FriendlyName”=“Moja bieżąca strona główna” “Flags”=dword:00000002 “Position”=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 “CurrentState”=hex:04,00,00,40 “OriginalStateInfo”=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 “RestoredStateInfo”=hex:18,00,00,00,12,03,00,00,23,00,00,00,dc,00,00,00,d2,00,\ 00,00,01,00,00,00 [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” “AVG7_Run”=“C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE” [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” “AVG7_Run”=“C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] “{438755C2-A8BA-11D1-B96B-00A0C90312E1}”=“Moduł wstępnego ładowania interfejsu Browseui” “{8C7461EF-2B13-11d2-BE35-3078302C2030}”=“Demon buforu kategorii składników” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] “{AEB6717E-7E19-11d0-97EE-00C04FD91972}”="" “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}”=“AVG Anti-Spyware 7.5” [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoDriveTypeAutoRun”=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] “dontdisplaylastusername”=dword:00000000 “legalnoticecaption”="" “legalnoticetext”="" “shutdownwithoutlogon”=dword:00000001 “undockwithoutlogon”=dword:00000001 [HKEY_USERS.default\software\microsoft\windows\currentversion\policies\explorer] “NoDriveTypeAutoRun”=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] “NoDriveTypeAutoRun”=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] “PostBootReminder”="{7849596a-48ea-486e-8937-a2a3009f31a9}" “CDBurn”="{fbeb8a05-beee-4442-804e-409d6c4515e9}" “WebCheck”="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" “SysTray”="{35CEC8A3-2BE6-11D2-8773-92E220524153}" “WPDShServiceObj”="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] “SecurityProviders”=“msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll” Completion time: 06-12-26 17:41:17.53 C:\ComboFix.txt … 06-12-26 17:41

[Bieniol (Bbieniol)]

Logi są czyste

Za pomocą tego narzędzia -> http://www.idg.pl/ftp/pc_9705/ATF.Cleaner…html -> opróżnij wszystkie TEMPy

Przeskanuj dysk tym -> http://dobreprogramy.pl/index.php?dz=2&id=1188&t=59 -> i usuń nim wszystko, co znajdzie

Wyłącz na chwilę przywracanie systemu:

Panel sterowania -> System -> Przywracanie systemu

Tam zaznacz opcję Turn off System Restore lub Turn off System Restore on all drives (Wyłącz przywracanie na wszystkich dyskach). Zatwierdzasz wszystkie zmiany.

[Electra (Noobenstein)]

Dzieki :]