Win32.Trojan Clicker wykrywa Ad-Aware

wozek53 · 24 Maj 2007 18:19

Joan · 24 Maj 2007 19:48

Ściągasz narzędzie KillBox, zaznaczasz Delete on Reboot, potem klikasz All Files i wklejasz do pola Full Path of File to Delete ścieżki:

C:\WINDOWS\system32\acleditbbvbbb.dll

Klikasz X i reset sysa.

Przeczyść rejestr – użyj do tego jv16 PowerTools 2006 1.5.2.344.

usun wpisy

Skan AVG AntySpyware 7.5 po update, wklej raport.

OT > kosz. Proszę nie bawić się w Moderatora.

wozek53 · 25 Maj 2007 08:59

Zrobiłem j.w .Dzięki za pomoc jak coś źle proszę mnie poprawić. nie mogłem użyc jv16 PowerTools 2006 1.5.2.344. komunikat aby go kupić. Czysciłem jv16 PowerTools 1.3. Raport AVG : --------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 10:39:20 2007-05-25 + Scan result: C:\WINDOWS\system32\b4fm.dll -> Adware.BurnFree : No action taken. C:\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.#ll -> Adware.Minibug : No action taken. E:\Program Files 2007-02-06 17;54;55\Common Files\Real\WeatherBug\MiniBugTransporter.#ll -> Adware.Minibug : No action taken. C:!KillBox\acleditbbvbbb.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP232\A0073673.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP232\A0073679.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP232\A0073687.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP233\A0073689.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP233\A0073690.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP234\A0073700.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP234\A0073707.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP234\A0073708.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP234\A0073943.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP234\A0073944.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP234\A0073945.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP235\A0073953.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP235\A0073954.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP238\A0074132.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP238\A0074133.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP238\A0074209.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP238\A0074210.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP238\A0074225.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP240\A0074335.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP240\A0074336.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP240\A0074337.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP242\A0074541.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP242\A0074542.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP242\A0074544.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP242\A0074552.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP242\A0074557.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP242\A0074558.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP243\A0074638.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP243\A0074639.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP243\A0074681.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP243\A0074682.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP243\A0074695.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP243\A0074696.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP243\A0074779.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP243\A0074780.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP243\A0074786.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP243\A0074821.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP243\A0074822.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP244\A0074880.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP244\A0074881.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP244\A0074882.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP244\A0074890.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP244\A0074896.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP244\A0074898.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP244\A0074899.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP244\A0074933.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP244\A0074934.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP244\A0074937.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP245\A0074954.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP245\A0074955.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP245\A0074968.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP245\A0074972.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP245\A0074979.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP245\A0074980.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP246\A0075015.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP246\A0075016.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP246\A0075066.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP246\A0075067.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP246\A0075068.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP247\A0075131.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP247\A0075145.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP247\A0075174.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP247\A0075216.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP248\A0075267.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP248\A0075268.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP248\A0075273.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP248\A0075285.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP248\A0075338.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP248\A0075342.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP248\A0075345.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP248\A0075352.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP248\A0075353.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP249\A0075364.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP249\A0075365.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP250\A0075499.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP250\A0075530.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP250\A0075538.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP254\A0075983.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP254\A0076004.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP254\A0076005.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP254\A0076014.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP255\A0076096.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP255\A0076100.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP255\A0076114.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP255\A0076115.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP255\A0076123.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP255\A0076124.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP255\A0076127.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP255\A0076137.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP255\A0076145.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP255\A0076146.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP255\A0076149.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP255\A0076155.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP258\A0076484.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP258\A0076485.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP258\A0076486.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP259\A0076487.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP259\A0076488.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP263\A0076506.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP263\A0076507.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP263\A0076508.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP264\A0076513.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP264\A0076514.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP264\A0076515.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP264\A0076521.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP264\A0076559.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP264\A0077912.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP264\A0078090.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP264\A0078091.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP264\A0078092.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP264\A0078277.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP264\A0078278.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP264\A0078280.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP264\A0078288.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP264\A0078289.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP264\A0078491.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP264\A0078492.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP264\A0078495.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078497.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078498.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078499.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078504.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078505.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078506.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078507.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078515.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078516.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078588.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078589.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078617.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078824.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078825.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078831.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078842.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078843.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078856.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078859.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078867.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078873.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078918.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078919.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0078920.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0079912.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP265\A0079913.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP266\A0079934.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP266\A0079935.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP266\A0079960.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP266\A0079961.dll -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP266\A0079970.exe -> Downloader.Small.ddp : No action taken. C:\System Volume Information_restore{AC6A2F20-0094-4945-81D7-CFBEC08917CE}\RP267\A0080188.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\4_cha.exe -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\6to4svca.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\6to4svcaa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\6to4svcab.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\6to4svcaba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\6to4svcabab.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\6to4svcav.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\6to4svcavb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\6to4svcavba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\6to4svcavbaa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\6to4svcavbaas.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\6to4svcb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ATIDEMGRb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ATIDEMGRba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ATIDEMGRbs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ATIDEMGRbsb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ATIDEMGRbsv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\AfpTa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\BitCometRess.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\BitCometRessv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\CddbCddab.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\aaaamonb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\aaaamonba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\aaaamonbb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\aaaamonbba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\aaaamonbbav.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\aaaamonbbavv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\aaaamonbbs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\aaaamonbbss.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\aaaamonbs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\aaaamonbss.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\aaaamonbv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\aaaamonbvs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\aaaamonbvv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\aaaamonbvva.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\aaaamons.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acledita.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditab.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditaba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditabab.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditas.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditbb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditbbv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditbbvb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditbbvbb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditbv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditbva.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditbvav.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditbvb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditbvs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditbvsb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditbvv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acleditbvvs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acluia.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acluiaa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acluiab.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acluiabb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acluib.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acluis.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acluisa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\acluisas.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\activedsa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\activedsab.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\activedsabs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\activedsabsb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\activedsabsbb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\activedsabv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\activedsav.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\activedsb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\activedsba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\activedsbaa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\activedsbaaa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\activedsbaaas.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\activedsbaav.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\activedsbv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\activedss.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\activedsv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\activedsvb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\actxprxya.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\actxprxyaa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\actxprxyab.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\actxprxyaba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\actxprxyav.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\actxprxys.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\actxprxysa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\actxprxysv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\actxprxyv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\actxprxyvv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\actxprxyvvb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\actxprxyvvba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\actxprxyvvbaa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\actxprxyvvbs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adptifa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adptifs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adptifsv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adptifsvv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpaa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpaas.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpaass.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpaassv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpaassvs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpaassvv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpaasv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpaasva.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpaasvs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpaav.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpaavs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpaavss.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbab.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbabb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbabs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbabsa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbabsav.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbabss.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbav.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbava.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbavs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbavsb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbavsv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbavv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbbab.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbsv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbsvs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbsvss.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpbv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpcb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpcba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpcbav.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpcbava.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpcbavv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpcs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpcv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsldpcva.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsmsexta.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsmsextas.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsmsextb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsmsextba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsmsextbb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsmsextbbv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsmsextbbvv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsmsextbbvvv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsmsexts.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsmsextv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsmsextva.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsmsextvab.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsmsextvabv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsmsextvv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\adsntv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\advapi32v.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\advapi32va.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\advapi32vav.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\advapi32vavv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\advapi32vs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\advapi32vsa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\advapi32vsb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\advapi32vv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\advapi32vvs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\advpacks.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\advpacksa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\advpacksav.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\advpacksavv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\advpackss.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\advpacksv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\alrsvca.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\alrsvcb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\alrsvcv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\alrsvcvs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\amstreamb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\amstreamba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\amstreambs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\amstreambv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\amstreambva.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\amstreambvb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\amstreambvbs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\apphelps.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\apphelpv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\asferrora.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\asferrors.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\asferrorsa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\asferrorsb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\asferrorsbb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\asferrorsbs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\asferrorsbv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\asferrorsbvb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\asferrorsbvba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\asferrorv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\asferrorvb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\asycfilta.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati2cqaga.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati2cqagaa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati2cqagav.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati2cqagv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati2cqagvb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati2cqagvba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati2cqagvs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati2cqagvv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati2dvaga.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati2dvagaa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati2dvagav.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati2dvags.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati2dvagsb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati2edxxb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati2edxxv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati3duags.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati3duagsv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati3duagv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati3duagvb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ati3duagvbb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atiiiexxs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atiiiexxsa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atiiiexxss.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atiiiexxssb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atiiiexxssv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atiiiexxssvb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atiiiexxssvbv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atikvmagb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atikvmagba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atikvmags.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atioglx1b.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atioglx1ba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atioglxxs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atipdlxxa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atipdlxxv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atitvo32v.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ativcoxxb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ativcoxxba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ativvaxxs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ativvaxxsv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atkctrss.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atl71a.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atl71v.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atls.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atlv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atlvv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atmfdv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atmfdva.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atmfdvab.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atmfdvav.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\atmliba.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\audiodeva.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\authzv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\autodiscs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\avifil32b.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\avtapia.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\avtapiaa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\avtapiaaa.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\avtapiaav.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\avtapis.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\avtapiv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\avwavs.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\b4fms.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\blackboxb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\blackboxv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\bootvidv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\bootvidvv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\browseuib.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\cabviewv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\capesnpna.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\cardsb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\ccfgntv.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\cdmb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\cdmodemb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\certmgrb.dll -> Downloader.Small.ddp : No action taken. C:\WINDOWS\system32\cfgbkenda.dll -> Downloader.Small.ddp : No action taken. C:\Documents and Settings\oem-pl\Cookies\oem-pl@site.skype[1].txt -> TrackingCookie.Skype : No action taken. C:\Documents and Settings\oem-pl\Cookies\oem-pl@skype[2].txt -> TrackingCookie.Skype : No action taken. C:\Documents and Settings\oem-pl\Cookies\oem-pl@m.webtrends[1].txt -> TrackingCookie.Webtrends : No action taken. C:\Program Files\Odkurzacz\Skins\VistaXP-VISTAXPB2.skn -> Trojan.Delf.mg : No action taken. E:\Program Files 2007-02-06 17;54;55\Odkurzacz\Skins\VistaXP-VISTAXPB2.skn -> Trojan.Delf.mg : No action taken. ::Report end

Gutek · 25 Maj 2007 17:30

Daj log z Combofix

wozek53 · 25 Maj 2007 18:29

“oem-pl” - 2007-05-25 20:16:26 Dodatek Service Pack 2 ComboFix 07-05.25.3V - Running from: “C:\Documents and Settings\oem-pl\Pulpit” ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-25 )))))))))))))))))))))))))))))))))) 2007-05-25 08:55 2007-05-23 09:09 1,300 --a------ C:\WINDOWS\system32\tmp.reg 2007-05-23 08:31 21,504 --a------ C:\WINDOWS\system32\actxprxyaba.dll 2007-05-22 20:54 21,504 --a------ C:\WINDOWS\system32\acleditas.dll 2007-05-22 20:46 21,504 --a------ C:\WINDOWS\system32\actxprxyab.dll 2007-05-22 20:02 21,504 --a------ C:\WINDOWS\system32\6to4svcabab.dll 2007-05-22 19:58 21,504 --a------ C:\WINDOWS\system32\aaaamons.dll 2007-05-22 19:29 21,504 --a------ C:\WINDOWS\system32\acleditbbvbb.dll 2007-05-22 18:52 21,504 --a------ C:\WINDOWS\system32\activedss.dll 2007-05-22 18:20 21,504 --a------ C:\WINDOWS\system32\activedsabv.dll 2007-05-22 18:20 21,504 --a------ C:\WINDOWS\system32\acleditbvvs.dll 2007-05-22 18:15 21,504 --a------ C:\WINDOWS\system32\aaaamonbbss.dll 2007-05-22 17:33 21,504 --a------ C:\WINDOWS\system32\adsldpaassvs.dll 2007-05-22 17:30 21,504 --a------ C:\WINDOWS\system32\adptifsvv.dll 2007-05-22 17:22 21,504 --a------ C:\WINDOWS\system32\acleditabab.dll 2007-05-22 17:17 21,504 --a------ C:\WINDOWS\system32\actxprxyvvbs.dll 2007-05-22 17:11 21,504 --a------ C:\WINDOWS\system32\acluiabb.dll 2007-05-22 17:00 21,504 --a------ C:\WINDOWS\system32\adsldpaavss.dll 2007-05-22 11:02 21,504 --a------ C:\WINDOWS\system32\activedsbaaas.dll 2007-05-22 10:32 21,504 --a------ C:\WINDOWS\system32\aaaamonbss.dll 2007-05-22 10:29 21,504 --a------ C:\WINDOWS\system32\acleditbvb.dll 2007-05-22 10:18 21,504 --a------ C:\WINDOWS\system32\actxprxyvvbaa.dll 2007-05-22 10:14 21,504 --a------ C:\WINDOWS\system32\acluiab.dll 2007-05-22 10:09 21,504 --a------ C:\WINDOWS\system32\aaaamonbvs.dll 2007-05-22 10:06 21,504 --a------ C:\WINDOWS\system32\acluisas.dll 2007-05-22 10:00 2007-05-21 20:39 21,504 --a------ C:\WINDOWS\system32\adsldpbavsb.dll 2007-05-21 20:38 21,504 --a------ C:\WINDOWS\system32\6to4svcavbaas.dll 2007-05-21 20:36 21,504 --a------ C:\WINDOWS\system32\6to4svcavbaa.dll 2007-05-21 20:12 21,504 --a------ C:\WINDOWS\system32\activedsvb.dll 2007-05-21 19:11 21,504 --a------ C:\WINDOWS\system32\actxprxysa.dll 2007-05-21 19:05 21,504 --a------ C:\WINDOWS\system32\6to4svcaba.dll 2007-05-21 18:59 2007-05-21 18:59 2007-05-21 18:54 7,287,808 --a------ C:\WINDOWS\system32\vistaui.exe 2007-05-21 18:54 414,009 --a------ C:\WINDOWS\system32\vimc.exe 2007-05-21 18:54 2007-05-21 18:54 2007-05-21 18:54 2007-05-21 18:54 2007-05-21 18:54 2007-05-21 18:50 2007-05-21 18:40 21,504 --a------ C:\WINDOWS\system32\adsldpbbab.dll 2007-05-21 18:32 2007-05-21 18:30 21,504 --a------ C:\WINDOWS\system32\actxprxyaa.dll 2007-05-21 18:22 21,504 --a------ C:\WINDOWS\system32\aaaamonbbavv.dll 2007-05-21 17:43 21,504 --a------ C:\WINDOWS\system32\acleditbvv.dll 2007-05-21 17:38 21,504 --a------ C:\WINDOWS\system32\activedsabsbb.dll 2007-05-21 16:22 21,504 --a------ C:\WINDOWS\system32\acleditbbvb.dll 2007-05-21 16:21 21,504 --a------ C:\WINDOWS\system32\6to4svcb.dll 2007-05-21 16:20 21,504 --a------ C:\WINDOWS\system32\adsldpbabss.dll 2007-05-21 10:26 21,504 --a------ C:\WINDOWS\system32\adptifsv.dll 2007-05-21 10:24 21,504 --a------ C:\WINDOWS\system32\actxprxyvvba.dll 2007-05-21 10:22 21,504 --a------ C:\WINDOWS\system32\adsldpbsvss.dll 2007-05-21 10:20 21,504 --a------ C:\WINDOWS\system32\adsldpaavs.dll 2007-05-21 10:18 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-05-21 09:57 21,504 --a------ C:\WINDOWS\system32\adsldpbabsav.dll 2007-05-21 09:30 21,504 --a------ C:\WINDOWS\system32\actxprxyvvb.dll 2007-05-21 09:29 21,504 --a------ C:\WINDOWS\system32\activedsbaav.dll 2007-05-20 20:46 21,504 --a------ C:\WINDOWS\system32\adsldpaasva.dll 2007-05-20 20:41 21,504 --a------ C:\WINDOWS\system32\adsldpbsvs.dll 2007-05-20 20:40 21,504 --a------ C:\WINDOWS\system32\adsmsextas.dll 2007-05-20 20:38 21,504 --a------ C:\WINDOWS\system32\aaaamonbbs.dll 2007-05-20 20:28 21,504 --a------ C:\WINDOWS\system32\adsldpcva.dll 2007-05-20 20:27 21,504 --a------ C:\WINDOWS\system32\activedsbaaa.dll 2007-05-20 20:27 21,504 --a------ C:\WINDOWS\system32\acleditbvav.dll 2007-05-20 19:55 21,504 --a------ C:\WINDOWS\system32\adsldpaav.dll 2007-05-20 17:46 21,504 --a------ C:\WINDOWS\system32\adsldpbv.dll 2007-05-20 17:43 21,504 --a------ C:\WINDOWS\system32\actxprxyvv.dll 2007-05-20 17:40 21,504 --a------ C:\WINDOWS\system32\acleditaba.dll 2007-05-20 17:39 21,504 --a------ C:\WINDOWS\system32\adsldpbsv.dll 2007-05-20 17:28 21,504 --a------ C:\WINDOWS\system32\adsmsextvabv.dll 2007-05-20 17:25 21,504 --a------ C:\WINDOWS\system32\acleditbbv.dll 2007-05-20 17:23 21,504 --a------ C:\WINDOWS\system32\adsntv.dll 2007-05-20 17:18 21,504 --a------ C:\WINDOWS\system32\adsldpaasvs.dll 2007-05-20 16:29 81,920 --a------ C:\WINDOWS\system32\closeapp.exe 2007-05-20 16:29 8,636 --a------ C:\WINDOWS\system32\modifype.exe 2007-05-20 16:29 19,968 --a------ C:\WINDOWS\system32\reico.exe 2007-05-20 16:29 2007-05-20 16:21 2007-05-20 16:03 38,643 --a------ C:\WINDOWS\BricoPackUninst.cmd 2007-05-20 16:01 2,155 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd 2007-05-20 16:00 2007-05-20 12:52 21,504 --a------ C:\WINDOWS\system32\adsmsextvab.dll 2007-05-20 12:52 21,504 --a------ C:\WINDOWS\system32\adsldpbba.dll 2007-05-20 12:49 21,504 --a------ C:\WINDOWS\system32\adsldpaassvv.dll 2007-05-20 12:47 21,504 --a------ C:\WINDOWS\system32\acleditbvsb.dll 2007-05-20 12:45 21,504 --a------ C:\WINDOWS\system32\adsldpbabsa.dll 2007-05-20 12:40 21,504 --a------ C:\WINDOWS\system32\adsldpaasv.dll 2007-05-20 12:37 21,504 --a------ C:\WINDOWS\system32\advapi32vsb.dll 2007-05-19 20:28 21,504 --a------ C:\WINDOWS\system32\adsldpaassv.dll 2007-05-19 20:22 21,504 --a------ C:\WINDOWS\system32\adsldpaass.dll 2007-05-19 18:45 21,504 --a------ C:\WINDOWS\system32\adsldpbavsv.dll 2007-05-19 16:35 21,504 --a------ C:\WINDOWS\system32\adsmsextva.dll 2007-05-19 16:17 2007-05-19 16:04 21,504 --a------ C:\WINDOWS\system32\actxprxyv.dll 2007-05-19 15:56 21,504 --a------ C:\WINDOWS\system32\acleditab.dll 2007-05-19 13:53 21,504 --a------ C:\WINDOWS\system32\6to4svcaa.dll 2007-05-19 13:52 21,504 --a------ C:\WINDOWS\system32\adsmsextba.dll 2007-05-19 13:04 21,504 --a------ C:\WINDOWS\system32\advapi32vsa.dll 2007-05-19 13:03 21,504 --a------ C:\WINDOWS\system32\advapi32vavv.dll 2007-05-19 13:03 21,504 --a------ C:\WINDOWS\system32\adsldpbavv.dll 2007-05-19 12:57 21,504 --a------ C:\WINDOWS\system32\advapi32vvs.dll 2007-05-19 12:48 21,504 --a------ C:\WINDOWS\system32\activedsv.dll 2007-05-18 20:59 21,504 --a------ C:\WINDOWS\system32\advpacksavv.dll 2007-05-18 20:57 21,504 --a------ C:\WINDOWS\system32\aaaamonbbav.dll 2007-05-18 19:25 21,504 --a------ C:\WINDOWS\system32\alrsvcvs.dll 2007-05-18 19:07 21,504 --a------ C:\WINDOWS\system32\actxprxyav.dll 2007-05-18 18:46 21,504 --a------ C:\WINDOWS\system32\adsldpaas.dll 2007-05-18 18:40 21,504 --a------ C:\WINDOWS\system32\adsldpbabb.dll 2007-05-18 18:32 2007-05-18 18:20 21,504 --a------ C:\WINDOWS\system32\alrsvca.dll 2007-05-18 18:14 21,504 --a------ C:\WINDOWS\system32\acleditbvs.dll 2007-05-18 18:13 21,504 --a------ C:\WINDOWS\system32\aaaamonba.dll 2007-05-18 18:11 21,504 --a------ C:\WINDOWS\system32\adsldpcbava.dll 2007-05-18 17:57 21,504 --a------ C:\WINDOWS\system32\advpacksv.dll 2007-05-18 17:56 21,504 --a------ C:\WINDOWS\system32\activedsbaa.dll 2007-05-18 17:55 21,504 --a------ C:\WINDOWS\system32\aaaamonbba.dll 2007-05-18 17:45 21,504 --a------ C:\WINDOWS\system32\aaaamonbvva.dll 2007-05-18 17:40 21,504 --a------ C:\WINDOWS\system32\advapi32vav.dll 2007-05-18 17:22 21,504 --a------ C:\WINDOWS\system32\activedsbv.dll 2007-05-18 17:18 21,504 --a------ C:\WINDOWS\system32\adsldpbb.dll 2007-05-18 17:13 21,504 --a------ C:\WINDOWS\system32\amstreambvbs.dll 2007-05-18 17:04 21,504 --a------ C:\WINDOWS\system32\acluib.dll 2007-05-18 16:53 21,504 --a------ C:\WINDOWS\system32\activedsabsb.dll 2007-05-18 16:53 2007-05-18 16:43 21,504 --a------ C:\WINDOWS\system32\adsldpbabs.dll 2007-05-18 16:40 21,504 --a------ C:\WINDOWS\system32\asferrorsbb.dll 2007-05-18 16:37 21,504 --a------ C:\WINDOWS\system32\actxprxysv.dll 2007-05-18 10:52 21,504 --a------ C:\WINDOWS\system32\amstreambvb.dll 2007-05-18 10:48 21,504 --a------ C:\WINDOWS\system32\adsmsextvv.dll 2007-05-18 10:47 21,504 --a------ C:\WINDOWS\system32\advpacksav.dll 2007-05-18 10:43 21,504 --a------ C:\WINDOWS\system32\amstreambva.dll 2007-05-18 10:43 21,504 --a------ C:\WINDOWS\system32\activedsabs.dll 2007-05-18 10:42 2007-05-18 08:51 21,504 --a------ C:\WINDOWS\system32\adsmsextv.dll 2007-05-18 08:48 21,504 --a------ C:\WINDOWS\system32\actxprxys.dll 2007-05-17 21:08 21,504 --a------ C:\WINDOWS\system32\6to4svcavba.dll 2007-05-17 21:05 21,504 --a------ C:\WINDOWS\system32\adsldpbs.dll 2007-05-17 20:48 21,504 --a------ C:\WINDOWS\system32\adsldpbava.dll 2007-05-17 20:17 21,504 --a------ C:\WINDOWS\system32\adsldpaa.dll 2007-05-17 20:13 21,504 --a------ C:\WINDOWS\system32\activedsav.dll 2007-05-17 20:10 21,504 --a------ C:\WINDOWS\system32\advapi32va.dll 2007-05-17 20:07 21,504 --a------ C:\WINDOWS\system32\amstreambv.dll 2007-05-17 20:07 21,504 --a------ C:\WINDOWS\system32\advapi32vs.dll 2007-05-17 19:55 21,504 --a------ C:\WINDOWS\system32\adsmsextbbvvv.dll 2007-05-17 19:55 2007-05-17 19:52 21,504 --a------ C:\WINDOWS\system32\adsldpcbavv.dll 2007-05-17 19:09 21,504 --a------ C:\WINDOWS\system32\advapi32vv.dll 2007-05-17 17:50 21,504 --a------ C:\WINDOWS\system32\asferrorsa.dll 2007-05-17 16:20 21,504 --a------ C:\WINDOWS\system32\adsmsextbbvv.dll 2007-05-17 10:17 21,504 --a------ C:\WINDOWS\system32\ati2cqagvv.dll 2007-05-17 10:16 21,504 --a------ C:\WINDOWS\system32\asferrorvb.dll 2007-05-17 10:16 21,504 --a------ C:\WINDOWS\system32\acleditbb.dll 2007-05-15 18:40 21,504 --a------ C:\WINDOWS\system32\advpackss.dll 2007-05-15 18:39 21,504 --a------ C:\WINDOWS\system32\acleditbva.dll 2007-05-15 18:32 21,504 --a------ C:\WINDOWS\system32\ati2dvagav.dll 2007-05-15 18:31 21,504 --a------ C:\WINDOWS\system32\asferrorsbvba.dll 2007-05-15 18:09 2007-05-14 20:58 2007-05-14 20:58 2007-05-14 20:55 21,504 --a------ C:\WINDOWS\system32\adsldpcbav.dll 2007-05-14 20:49 21,504 --a------ C:\WINDOWS\system32\asferrorsbvb.dll 2007-05-14 20:46 21,504 --a------ C:\WINDOWS\system32\ati2edxxb.dll 2007-05-14 20:04 21,504 --a------ C:\WINDOWS\system32\ati3duagvbb.dll 2007-05-14 20:04 21,504 --a------ C:\WINDOWS\system32\ati2cqagav.dll 2007-05-14 20:01 21,504 --a------ C:\WINDOWS\system32\aaaamonbvv.dll 2007-05-14 19:57 21,504 --a------ C:\WINDOWS\system32\activedsab.dll 2007-05-14 19:17 21,504 --a------ C:\WINDOWS\system32\adptifa.dll 2007-05-14 18:37 21,504 --a------ C:\WINDOWS\system32\adsmsextbbv.dll 2007-05-14 18:30 21,504 --a------ C:\WINDOWS\system32\ati2cqagaa.dll 2007-05-14 18:28 21,504 --a------ C:\WINDOWS\system32\acleditbv.dll 2007-05-14 16:47 21,504 --a------ C:\WINDOWS\system32\adsldpbab.dll 2007-05-14 16:29 21,504 --a------ C:\WINDOWS\system32\amstreamba.dll 2007-05-13 18:25 21,504 --a------ C:\WINDOWS\system32\adsmsexta.dll 2007-05-13 18:24 21,504 --a------ C:\WINDOWS\system32\ATIDEMGRbsb.dll 2007-05-13 18:08 21,504 --a------ C:\WINDOWS\system32\aaaamonbb.dll 2007-05-13 18:01 21,504 --a------ C:\WINDOWS\system32\acluiaa.dll 2007-05-13 16:47 21,504 --a------ C:\WINDOWS\system32\ati2edxxv.dll 2007-05-13 16:04 21,504 --a------ C:\WINDOWS\system32\ATIDEMGRbsv.dll 2007-05-13 13:51 21,504 --a------ C:\WINDOWS\system32\adsmsextbb.dll 2007-05-13 13:50 21,504 --a------ C:\WINDOWS\system32\amstreambs.dll 2007-05-13 13:49 21,504 --a------ C:\WINDOWS\system32\adsldpbavs.dll 2007-05-13 13:48 21,504 --a------ C:\WINDOWS\system32\apphelpv.dll 2007-05-13 13:47 21,504 --a------ C:\WINDOWS\system32\6to4svcavb.dll 2007-05-13 13:37 21,504 --a------ C:\WINDOWS\system32\ati2dvagsb.dll 2007-05-13 13:33 21,504 --a------ C:\WINDOWS\system32\atiiiexxssvbv.dll 2007-05-13 13:29 21,504 --a------ C:\WINDOWS\system32\atioglx1ba.dll 2007-05-13 13:14 21,504 --a------ C:\WINDOWS\system32\adptifs.dll 2007-05-12 21:30 21,504 --a------ C:\WINDOWS\system32\atikvmagba.dll 2007-05-12 21:19 21,504 --a------ C:\WINDOWS\system32\asferrorsbs.dll 2007-05-12 20:35 21,504 --a------ C:\WINDOWS\system32\6to4svcab.dll 2007-05-12 20:33 21,504 --a------ C:\WINDOWS\system32\ati2cqagvs.dll 2007-05-12 17:52 21,504 --a------ C:\WINDOWS\system32\acluisa.dll 2007-05-12 17:15 21,504 --a------ C:\WINDOWS\system32\adsmsexts.dll 2007-05-12 16:55 21,504 --a------ C:\WINDOWS\system32\asycfilta.dll 2007-05-12 16:54 21,504 --a------ C:\WINDOWS\system32\ati2cqagvba.dll 2007-05-12 16:53 21,504 --a------ C:\WINDOWS\system32\ATIDEMGRba.dll 2007-05-12 16:53 21,504 --a------ C:\WINDOWS\system32\acleditba.dll 2007-05-12 16:42 21,504 --a------ C:\WINDOWS\system32\atipdlxxa.dll 2007-05-12 16:17 21,504 --a------ C:\WINDOWS\system32\atioglxxs.dll 2007-05-12 16:14 21,504 --a------ C:\WINDOWS\system32\adsmsextb.dll 2007-05-12 16:02 21,504 --a------ C:\WINDOWS\system32\atikvmagb.dll 2007-05-12 16:02 21,504 --a------ C:\WINDOWS\system32\asferrora.dll 2007-05-12 16:00 2007-05-12 15:54 21,504 --a------ C:\WINDOWS\system32\atiiiexxssvb.dll 2007-05-12 15:46 21,504 --a------ C:\WINDOWS\system32\asferrorsbv.dll 2007-05-12 15:45 21,504 --a------ C:\WINDOWS\system32\adsldpbav.dll 2007-05-12 15:44 21,504 --a------ C:\WINDOWS\system32\ati3duagsv.dll 2007-05-12 15:41 21,504 --a------ C:\WINDOWS\system32\acleditb.dll 2007-05-12 14:04 21,504 --a------ C:\WINDOWS\system32\atkctrss.dll 2007-05-12 14:04 21,504 --a------ C:\WINDOWS\system32\advpacksa.dll 2007-05-12 13:53 21,504 --a------ C:\WINDOWS\system32\advpacks.dll 2007-05-12 13:52 21,504 --a------ C:\WINDOWS\system32\ati2dvagaa.dll 2007-05-12 13:50 21,504 --a------ C:\WINDOWS\system32\atlvv.dll 2007-05-11 21:00 21,504 --a------ C:\WINDOWS\system32\6to4svcav.dll 2007-05-11 20:47 21,504 --a------ C:\WINDOWS\system32\advapi32v.dll 2007-05-11 20:26 21,504 --a------ C:\WINDOWS\system32\adsldpcba.dll 2007-05-11 20:18 21,504 --a------ C:\WINDOWS\system32\ATIDEMGRbs.dll 2007-05-11 20:07 21,504 --a------ C:\WINDOWS\system32\atmfdvav.dll 2007-05-11 19:34 21,504 --a------ C:\WINDOWS\system32\asferrorsb.dll 2007-05-11 19:29 21,504 --a------ C:\WINDOWS\system32\ati3duags.dll 2007-05-11 19:10 21,504 --------- C:\WINDOWS\system32\ativcoxxba.dll 2007-05-11 19:02 21,504 --a------ C:\WINDOWS\system32\6to4svca.dll 2007-05-11 18:08 21,504 --------- C:\WINDOWS\system32\AfpTa.dll 2007-05-11 17:28 21,504 --------- C:\WINDOWS\system32\atiiiexxssb.dll 2007-05-11 17:27 21,504 --------- C:\WINDOWS\system32\atlv.dll 2007-05-11 17:25 21,504 --------- C:\WINDOWS\system32\atmfdvab.dll 2007-05-11 16:35 21,504 --------- C:\WINDOWS\system32\ati2cqaga.dll 2007-05-11 16:28 21,504 --------- C:\WINDOWS\system32\atmfdva.dll 2007-05-11 16:11 21,504 --------- C:\WINDOWS\system32\ativvaxxsv.dll 2007-05-11 14:11 21,504 --a------ C:\WINDOWS\system32\adsldpba.dll 2007-05-11 14:05 21,504 --------- C:\WINDOWS\system32\adsldpcv.dll 2007-05-11 13:22 21,504 --------- C:\WINDOWS\system32\alrsvcv.dll 2007-05-11 12:59 21,504 --a------ C:\WINDOWS\system32\acluia.dll 2007-05-11 09:55 21,504 --------- C:\WINDOWS\system32\autodiscs.dll 2007-05-11 09:55 21,504 --------- C:\WINDOWS\system32\ati2dvaga.dll 2007-05-11 09:55 21,504 --------- C:\WINDOWS\system32\adsldpcb.dll 2007-05-11 09:54 21,504 --------- C:\WINDOWS\system32\apphelps.dll 2007-05-11 09:49 21,504 --a------ C:\WINDOWS\system32\atioglx1b.dll 2007-05-11 09:47 21,504 --a------ C:\WINDOWS\system32\ati3duagvb.dll 2007-05-11 09:44 21,504 --a------ C:\WINDOWS\system32\asferrors.dll 2007-05-11 09:44 21,504 --------- C:\WINDOWS\system32\authzv.dll 2007-05-11 09:43 21,504 --------- C:\WINDOWS\system32\atl71a.dll 2007-05-11 09:36 21,504 --a------ C:\WINDOWS\system32\adsldpb.dll 2007-05-11 09:23 21,504 --------- C:\WINDOWS\system32\audiodeva.dll 2007-05-11 09:21 21,504 --------- C:\WINDOWS\system32\atiiiexxssv.dll 2007-05-11 09:18 21,504 --------- C:\WINDOWS\system32\ativcoxxb.dll 2007-05-10 21:53 21,504 --------- C:\WINDOWS\system32\ati2cqagvb.dll 2007-05-10 21:43 21,504 --------- C:\WINDOWS\system32\ATIDEMGRb.dll 2007-05-10 21:41 21,504 --a------ C:\WINDOWS\system32\alrsvcb.dll 2007-05-10 21:34 21,504 --------- C:\WINDOWS\system32\avtapiaav.dll 2007-05-10 21:33 21,504 --------- C:\WINDOWS\system32\atmliba.dll 2007-05-10 21:12 21,504 --------- C:\WINDOWS\system32\amstreamb.dll 2007-05-10 21:04 21,504 --------- C:\WINDOWS\system32\avtapiaaa.dll 2007-05-10 21:00 21,504 --------- C:\WINDOWS\system32\aaaamonbv.dll 2007-05-10 20:58 21,504 --------- C:\WINDOWS\system32\avtapiv.dll 2007-05-10 20:39 21,504 --------- C:\WINDOWS\system32\avifil32b.dll 2007-05-10 20:28 21,504 --------- C:\WINDOWS\system32\activedsa.dll 2007-05-10 20:19 21,504 --------- C:\WINDOWS\system32\bootvidvv.dll 2007-05-10 20:14 21,504 --------- C:\WINDOWS\system32\activedsba.dll 2007-05-10 19:53 21,504 --------- C:\WINDOWS\system32\activedsb.dll 2007-05-10 18:53 21,504 --------- C:\WINDOWS\system32\ativvaxxs.dll 2007-05-10 18:32 21,504 --------- C:\WINDOWS\system32\adsldpa.dll 2007-05-10 18:27 21,504 --------- C:\WINDOWS\system32\acluis.dll 2007-05-10 18:26 21,504 --------- C:\WINDOWS\system32\bootvidv.dll 2007-05-10 18:26 21,504 --------- C:\WINDOWS\system32\blackboxv.dll 2007-05-10 18:21 21,504 --------- C:\WINDOWS\system32\acledita.dll 2007-05-10 18:20 21,504 --------- C:\WINDOWS\system32\avtapiaa.dll 2007-05-10 18:17 21,504 --a------ C:\WINDOWS\system32\adsldpcs.dll 2007-05-10 17:52 21,504 --------- C:\WINDOWS\system32\atiiiexxsa.dll 2007-05-10 17:08 21,504 --------- C:\WINDOWS\system32\BitCometRessv.dll 2007-05-10 17:07 21,504 --------- C:\WINDOWS\system32\asferrorv.dll 2007-05-10 17:04 21,504 --------- C:\WINDOWS\system32\atiiiexxss.dll 2007-05-10 16:46 21,504 --------- C:\WINDOWS\system32\atitvo32v.dll 2007-05-10 16:25 21,504 --------- C:\WINDOWS\system32\browseuib.dll 2007-05-10 16:16 21,504 --------- C:\WINDOWS\system32\ati2dvags.dll 2007-05-10 14:10 21,504 --------- C:\WINDOWS\system32\cardsb.dll 2007-05-10 14:09 21,504 --------- C:\WINDOWS\system32\BitCometRess.dll 2007-05-10 14:06 21,504 --------- C:\WINDOWS\system32\atikvmags.dll 2007-05-10 14:05 21,504 --------- C:\WINDOWS\system32\capesnpna.dll 2007-05-10 13:57 21,504 --a------ C:\WINDOWS\system32\aaaamonbs.dll 2007-05-10 13:56 21,504 --------- C:\WINDOWS\system32\atl71v.dll 2007-05-10 13:54 21,504 --------- C:\WINDOWS\system32\ccfgntv.dll 2007-05-10 13:42 21,504 --------- C:\WINDOWS\system32\CddbCddab.dll 2007-05-10 13:40 21,504 --------- C:\WINDOWS\system32\avtapis.dll 2007-05-10 13:36 21,504 --------- C:\WINDOWS\system32\ati2cqagv.dll 2007-05-10 13:21 21,504 --------- C:\WINDOWS\system32\atiiiexxs.dll 2007-05-10 13:15 21,504 --------- C:\WINDOWS\system32\cdmodemb.dll 2007-05-10 13:11 21,504 --------- C:\WINDOWS\system32\atmfdv.dll 2007-05-10 12:56 21,504 --------- C:\WINDOWS\system32\cabviewv.dll 2007-05-10 12:56 21,504 --------- C:\WINDOWS\system32\aaaamonb.dll 2007-05-10 12:53 21,504 --------- C:\WINDOWS\system32\cdmb.dll 2007-05-10 12:51 21,504 --------- C:\WINDOWS\system32\blackboxb.dll 2007-05-10 12:45 21,504 --------- C:\WINDOWS\system32\avwavs.dll 2007-05-10 09:37 21,504 --------- C:\WINDOWS\system32\cfgbkenda.dll 2007-05-10 09:14 21,504 --------- C:\WINDOWS\system32\ati3duagv.dll 2007-05-09 22:02 21,504 --------- C:\WINDOWS\system32\atls.dll 2007-05-09 21:49 21,504 --------- C:\WINDOWS\system32\avtapia.dll 2007-05-09 21:21 21,504 --------- C:\WINDOWS\system32\certmgrb.dll 2007-05-09 21:04 21,504 --------- C:\WINDOWS\system32\actxprxya.dll 2007-05-09 20:19 21,504 --------- C:\WINDOWS\system32\b4fms.dll 2007-05-09 20:14 27,648 --a------ C:\WINDOWS\4_cha.exe 2007-05-09 20:14 21,504 --------- C:\WINDOWS\system32\atipdlxxv.dll 2007-05-09 19:54 2007-05-08 20:29 2007-05-08 17:59 2007-05-05 10:49 24,512 --------- C:\WINDOWS\system32\drivers\VBoxDrv.sys 2007-05-05 10:49 18,720 --------- C:\WINDOWS\system32\drivers\VBoxUSBFlt.sys 2007-05-02 18:41 2007-05-01 17:56 2007-05-01 17:55 2007-05-01 17:54 2007-05-01 15:03 22,112 -r------- C:\WINDOWS\system32\drivers\COH_Mon.sys 2007-05-01 14:28 8,704 --a------ C:\WINDOWS\system32\fxsperf.dll 2007-05-01 14:28 72,192 --a------ C:\WINDOWS\system32\fxscom.dll 2007-05-01 14:28 7,168 --a------ C:\WINDOWS\system32\fxsres.dll 2007-05-01 14:28 58,880 --a------ C:\WINDOWS\system32\fxsevent.dll 2007-05-01 14:28 562,688 --a------ C:\WINDOWS\system32\fxsst.dll 2007-05-01 14:28 452,096 --a------ C:\WINDOWS\system32\fxsapi.dll 2007-05-01 14:28 400,896 --a------ C:\WINDOWS\system32\fxsxp32.dll 2007-05-01 14:28 397,312 --a------ C:\WINDOWS\system32\fxstiff.dll 2007-05-01 14:28 31,744 --a------ C:\WINDOWS\system32\fxsroute.dll 2007-05-01 14:28 285,184 --a------ C:\WINDOWS\system32\fxscomex.dll 2007-05-01 14:28 27,136 --a------ C:\WINDOWS\system32\fxsdrv.dll 2007-05-01 14:28 268,288 --a------ C:\WINDOWS\system32\fxssvc.exe 2007-05-01 14:28 246,272 --a------ C:\WINDOWS\system32\fxst30.dll 2007-05-01 14:28 233,472 --a------ C:\WINDOWS\system32\fxscover.exe 2007-05-01 14:28 23,552 --a------ C:\WINDOWS\system32\fxsmon.dll 2007-05-01 14:28 23,552 --a------ C:\WINDOWS\system32\fxsext32.dll 2007-05-01 14:28 194,560 --a------ C:\WINDOWS\system32\fxswzrd.dll 2007-05-01 14:28 155,648 --a------ C:\WINDOWS\system32\fxsui.dll 2007-05-01 14:28 143,360 --a------ C:\WINDOWS\system32\fxsclnt.exe 2007-05-01 14:28 137,728 --a------ C:\WINDOWS\system32\fxsclntR.dll 2007-05-01 14:28 112,128 --a------ C:\WINDOWS\system32\fxscfgwz.dll 2007-05-01 14:28 11,264 --a------ C:\WINDOWS\system32\fxssend.exe 2007-05-01 14:28 2007-04-28 15:24 51,200 --------- C:\WINDOWS\system32\dumphive.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-25 18:15:56 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Skype 2007-05-25 08:37:01 -------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-05-25 08:14:14 41 ----a-w C:\WINDOWS\system32\bbafadcf4_s.dll 2007-05-21 17:02:35 89,190 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-05-21 17:02:35 499,364 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-05-10 10:58:06 -------- d-----w C:\Program Files\IE7pro 2007-05-02 18:44:59 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Ashampoo 2007-05-01 15:56:14 -------- d-----w C:\Program Files\Common Files\Real 2007-04-29 13:37:14 -------- d-----w C:\Program Files\ATITool 2007-04-23 08:05:14 100,482 ------w C:\WINDOWS\UninstallThunderbird.exe 2007-04-23 08:05:08 15,749 ------w C:\WINDOWS\mozver.dat 2007-04-21 14:07:13 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Media Player Classic 2007-04-20 17:10:44 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Nokia 2007-04-20 16:28:38 -------- d-----w C:\Program Files\DAEMON Tools 2007-04-20 15:41:55 682,232 ------w C:\WINDOWS\system32\drivers\sptd.sys 2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-04-16 20:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-04-16 20:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll 2007-04-13 16:16:20 71,680 ------w C:\WINDOWS\g2806421.exe 2007-04-13 15:54:18 71,680 ------w C:\WINDOWS\g1485031.exe 2007-04-13 15:32:18 71,680 ------w C:\WINDOWS\g164625.exe 2007-04-11 10:07:44 -------- d-----w C:\Program Files\IrfanView 2007-04-08 13:02:52 -------- d-----w C:\Program Files\Odkurzacz 2007-04-07 13:54:30 -------- d-----w C:\Program Files\Norton Internet Security 2007-04-07 13:44:48 491,840 --sh–w C:\WINDOWS\system32\efhkj.ini2 2007-04-07 13:25:45 491,302 --sh–w C:\WINDOWS\system32\efhkj.bak2 2007-04-01 18:32:57 -------- d-----w C:\Program Files\Ahead 2007-04-01 13:10:35 484,866 --sh–w C:\WINDOWS\system32\efhkj.bak1 2007-03-31 13:31:23 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-03-28 21:26:48 -------- d-----w C:\Program Files\Skype 2007-03-28 21:26:47 -------- d-----w C:\Program Files\Common Files\Skype 2007-03-26 14:53:13 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Creative 2007-03-26 14:51:48 -------- d-----w C:\Program Files\Creative 2007-03-25 19:21:39 223,128 ------w C:\WINDOWS\system32\drivers\vaxscsi.sys 2007-03-25 17:38:54 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Nokia Multimedia Player 2007-03-25 17:28:47 -------- d-----w C:\Program Files\Common Files\PCSuite 2007-03-25 17:28:43 -------- d-----w C:\Program Files\Common Files\Nokia 2007-03-25 17:28:42 -------- d-----w C:\Program Files\Nokia 2007-03-25 14:50:24 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\PC Suite 2007-03-25 14:49:32 -------- d-----w C:\Program Files\DIFX 2007-03-23 04:07:56 1,683,280 ------w C:\WINDOWS\system32\XpsSvcs.dll 2007-03-23 04:07:54 583,504 ------w C:\WINDOWS\system32\XPSSHHDR.dll 2007-03-22 18:25:02 124,928 ------w C:\WINDOWS\system32\prntvpt.dll 2007-03-21 20:57:31 2,560 ------w C:\WINDOWS_MSRSTRT.EXE 2007-03-17 13:45:36 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-16 11:36:53 2,560 ------w C:\WINDOWS\system32\BitCometRes.dll 2007-03-11 21:12:56 -------- d-----w C:\Program Files\Reference Assemblies 2007-03-11 15:21:49 -------- d-----w C:\Program Files\NeoSmart Technologies 2007-03-10 16:32:51 -------- d-----w C:\Program Files\Microsoft.NET 2007-03-09 14:58:40 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\uTorrent 2007-03-09 12:02:21 -------- d-----w C:\Program Files\Common Files\Astonsoft 2007-03-08 19:44:19 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\DeepBurner Pro 2007-03-08 17:22:52 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\GSplit 2007-03-08 17:22:34 -------- d-----w C:\Program Files\Google 2007-03-08 17:18:05 -------- d-----w C:\Program Files\NCH Swift Sound 2007-03-08 17:18:05 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\NCH Swift Sound 2007-03-08 17:08:02 -------- d-----w C:\Program Files\Ashampoo 2007-03-08 16:51:22 21,120 ------w C:\WINDOWS\system32\drivers\nchssvad.sys 2007-03-08 15:38:47 579,072 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:38:47 40,960 ------w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:38:47 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:37:33 1,843,840 ------w C:\WINDOWS\system32\win32k.sys 2007-02-05 20:19:48 185,856 ------w C:\WINDOWS\system32\upnphost.dll 2006-12-17 14:22:43 2,516 --sh–w C:\WINDOWS\system32\KGyGaAvL.sys (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {0edc6c20-a31c-11db-8ab9-0800200c9a66}=C:\WINDOWS\system32\acleditbbvbbb.dll [] {1E8A6170-7264-4D0F-BEAE-D42A53123C75}=C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll [2006-09-06 08:18] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}=D:\Programy\Scąganie z netu\BitComet\tools\BitCometBHO_1.1.2.7.dll [] {72853161-30C5-4D22-B7F9-0BBC1D38A37E}=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 01:48] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [2006-12-15 03:23] {85F685C3-20D9-4943-95E4-EB4224056C3F}=E:\odtwarzacz z napis\Expressivo Demo\IH_iexplore.dll [2006-12-13 14:40] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 10:50] “osCheck”=“C:\Program Files\Norton Internet Security\osCheck.exe” [2006-09-06 04:22] “ccApp”=“C:\Program Files\Common Files\Symantec Shared\ccApp.exe” [2007-01-09 22:59] “!AVG Anti-Spyware”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” [2006-10-07 14:20] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 14:00] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-03-23 13:52] “WMPNSCFG”=“C:\Program Files\Windows Media Player\WMPNSCFG.exe” [2006-12-01 12:46] “Expressivo”=“E:\odtwarzacz z napis\Expressivo Demo\expressivo.exe” [2006-12-13 15:09] [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “PcSync”=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoLowDiskSpaceChecks”=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll” [2006-09-28 16:13] “{B5A7F190-DDA6-4420-B3BA-52453494E6CD}”=“C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [2006-10-27 01:48] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ATI CATALYST – pasek zadań.lnk] backup=C:\WINDOWS\pss\ATI CATALYST – pasek zadań.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Kalendarz XP.lnk] backup=C:\WINDOWS\pss\Kalendarz XP.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^NaturalColorLoad.lnk] backup=C:\WINDOWS\pss\NaturalColorLoad.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^oem-pl^Menu Start^Programy^Autostart^NaturalColorLoad.lnk] backup=C:\WINDOWS\pss\NaturalColorLoad.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^oem-pl^Menu Start^Programy^Autostart^UniSpiker-2.6.lnk] backup=C:\WINDOWS\pss\UniSpiker-2.6.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] “C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CamTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1045 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] “C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HydraVisionViewPort] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LClock] C:\Program Files\LClock\LClock.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger] MSMSGS [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ] “C:\PROGRA~1\Ahead\NEROBA~1\NBJ.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RocketDock] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SeaMonkey Quick Launch] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Styler] C:\Program Files\Styler\Styler.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] “C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue SpyEraser] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive] “C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe” /s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe *Newly Created Service* -COMHOST Contents of the ‘Scheduled Tasks’ folder 2006-12-06 15:56:54 C:\WINDOWS\tasks\Idle Time Backup.job 2007-05-25 15:47:01 C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - oem-pl.job 2007-05-20 11:28:17 C:\WINDOWS\tasks\Uniblue SpyEraser Nag.job 2007-05-19 18:20:23 C:\WINDOWS\tasks\Uniblue SpyEraser.job ******************************************************************** catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-25 20:18:25 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ******************************************************************** Completion time: 2007-05-25 20:19:04 C:\ComboFix-quarantined-files.txt … 2007-05-25 20:19 C:\ComboFix2.txt … 2007-05-23 09:44 C:\ComboFix3.txt … 2007-05-21 10:18 — E O F —

Joan · 25 Maj 2007 20:47

usuń wszystko, co znalazł avg, i wtedy daj nowy log z combofixa

wozek53 · 26 Maj 2007 19:11

co mogłem usunęłem.Reszty nie moę.proszę o pomoc. logi “oem-pl” - 2007-05-26 20:59:05 Dodatek Service Pack 2 ComboFix 07-05.25.3V - Running from: “C:\Documents and Settings\oem-pl\Pulpit” ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-26 )))))))))))))))))))))))))))))))))) 2007-05-25 08:55 2007-05-23 09:09 1,300 --a------ C:\WINDOWS\system32\tmp.reg 2007-05-22 10:00 2007-05-21 18:59 2007-05-21 18:59 2007-05-21 18:54 7,287,808 --a------ C:\WINDOWS\system32\vistaui.exe 2007-05-21 18:54 414,009 --a------ C:\WINDOWS\system32\vimc.exe 2007-05-21 18:54 2007-05-21 18:54 2007-05-21 18:54 2007-05-21 18:54 2007-05-21 18:54 2007-05-21 18:50 2007-05-21 18:32 2007-05-21 10:18 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-05-20 16:29 81,920 --a------ C:\WINDOWS\system32\closeapp.exe 2007-05-20 16:29 8,636 --a------ C:\WINDOWS\system32\modifype.exe 2007-05-20 16:29 19,968 --a------ C:\WINDOWS\system32\reico.exe 2007-05-20 16:29 2007-05-20 16:21 2007-05-20 16:03 38,643 --a------ C:\WINDOWS\BricoPackUninst.cmd 2007-05-20 16:01 2,155 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd 2007-05-20 16:00 2007-05-19 16:17 2007-05-18 18:32 2007-05-18 16:53 2007-05-18 10:42 2007-05-17 19:55 2007-05-15 18:09 2007-05-14 20:58 2007-05-14 20:58 2007-05-12 16:00 2007-05-09 21:04 21,504 --a------ C:\WINDOWS\system32\actxprxya.dll 2007-05-09 19:54 2007-05-08 20:29 2007-05-08 17:59 2007-05-05 10:49 24,512 --------- C:\WINDOWS\system32\drivers\VBoxDrv.sys 2007-05-05 10:49 18,720 --------- C:\WINDOWS\system32\drivers\VBoxUSBFlt.sys 2007-05-02 18:41 2007-05-01 17:56 2007-05-01 17:55 2007-05-01 17:54 2007-05-01 15:03 22,112 -r------- C:\WINDOWS\system32\drivers\COH_Mon.sys 2007-05-01 14:28 8,704 --a------ C:\WINDOWS\system32\fxsperf.dll 2007-05-01 14:28 72,192 --a------ C:\WINDOWS\system32\fxscom.dll 2007-05-01 14:28 7,168 --a------ C:\WINDOWS\system32\fxsres.dll 2007-05-01 14:28 58,880 --a------ C:\WINDOWS\system32\fxsevent.dll 2007-05-01 14:28 562,688 --a------ C:\WINDOWS\system32\fxsst.dll 2007-05-01 14:28 452,096 --a------ C:\WINDOWS\system32\fxsapi.dll 2007-05-01 14:28 400,896 --a------ C:\WINDOWS\system32\fxsxp32.dll 2007-05-01 14:28 397,312 --a------ C:\WINDOWS\system32\fxstiff.dll 2007-05-01 14:28 31,744 --a------ C:\WINDOWS\system32\fxsroute.dll 2007-05-01 14:28 285,184 --a------ C:\WINDOWS\system32\fxscomex.dll 2007-05-01 14:28 27,136 --a------ C:\WINDOWS\system32\fxsdrv.dll 2007-05-01 14:28 268,288 --a------ C:\WINDOWS\system32\fxssvc.exe 2007-05-01 14:28 246,272 --a------ C:\WINDOWS\system32\fxst30.dll 2007-05-01 14:28 233,472 --a------ C:\WINDOWS\system32\fxscover.exe 2007-05-01 14:28 23,552 --a------ C:\WINDOWS\system32\fxsmon.dll 2007-05-01 14:28 23,552 --a------ C:\WINDOWS\system32\fxsext32.dll 2007-05-01 14:28 194,560 --a------ C:\WINDOWS\system32\fxswzrd.dll 2007-05-01 14:28 155,648 --a------ C:\WINDOWS\system32\fxsui.dll 2007-05-01 14:28 143,360 --a------ C:\WINDOWS\system32\fxsclnt.exe 2007-05-01 14:28 137,728 --a------ C:\WINDOWS\system32\fxsclntR.dll 2007-05-01 14:28 112,128 --a------ C:\WINDOWS\system32\fxscfgwz.dll 2007-05-01 14:28 11,264 --a------ C:\WINDOWS\system32\fxssend.exe 2007-05-01 14:28 2007-04-28 15:24 51,200 --------- C:\WINDOWS\system32\dumphive.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-26 18:54:19 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Skype 2007-05-26 07:00:56 -------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-05-25 08:14:14 41 ----a-w C:\WINDOWS\system32\bbafadcf4_s.dll 2007-05-21 17:02:35 89,190 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-05-21 17:02:35 499,364 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-05-10 10:58:06 -------- d-----w C:\Program Files\IE7pro 2007-05-02 18:44:59 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Ashampoo 2007-05-01 15:56:14 -------- d-----w C:\Program Files\Common Files\Real 2007-04-29 13:37:14 -------- d-----w C:\Program Files\ATITool 2007-04-23 08:05:14 100,482 ------w C:\WINDOWS\UninstallThunderbird.exe 2007-04-23 08:05:08 15,749 ------w C:\WINDOWS\mozver.dat 2007-04-21 14:07:13 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Media Player Classic 2007-04-20 17:10:44 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Nokia 2007-04-20 16:28:38 -------- d-----w C:\Program Files\DAEMON Tools 2007-04-20 15:41:55 682,232 ------w C:\WINDOWS\system32\drivers\sptd.sys 2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-04-16 20:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-04-16 20:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll 2007-04-13 16:16:20 71,680 ------w C:\WINDOWS\g2806421.exe 2007-04-13 15:54:18 71,680 ------w C:\WINDOWS\g1485031.exe 2007-04-13 15:32:18 71,680 ------w C:\WINDOWS\g164625.exe 2007-04-11 10:07:44 -------- d-----w C:\Program Files\IrfanView 2007-04-08 13:02:52 -------- d-----w C:\Program Files\Odkurzacz 2007-04-07 13:54:30 -------- d-----w C:\Program Files\Norton Internet Security 2007-04-07 13:44:48 491,840 --sh–w C:\WINDOWS\system32\efhkj.ini2 2007-04-07 13:25:45 491,302 --sh–w C:\WINDOWS\system32\efhkj.bak2 2007-04-01 18:32:57 -------- d-----w C:\Program Files\Ahead 2007-04-01 13:10:35 484,866 --sh–w C:\WINDOWS\system32\efhkj.bak1 2007-03-31 13:31:23 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-03-28 21:26:48 -------- d-----w C:\Program Files\Skype 2007-03-28 21:26:47 -------- d-----w C:\Program Files\Common Files\Skype 2007-03-26 14:53:13 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Creative 2007-03-26 14:51:48 -------- d-----w C:\Program Files\Creative 2007-03-25 19:21:39 223,128 ------w C:\WINDOWS\system32\drivers\vaxscsi.sys 2007-03-25 17:38:54 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Nokia Multimedia Player 2007-03-25 17:28:47 -------- d-----w C:\Program Files\Common Files\PCSuite 2007-03-25 17:28:43 -------- d-----w C:\Program Files\Common Files\Nokia 2007-03-25 17:28:42 -------- d-----w C:\Program Files\Nokia 2007-03-25 14:50:24 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\PC Suite 2007-03-25 14:49:32 -------- d-----w C:\Program Files\DIFX 2007-03-23 04:07:56 1,683,280 ------w C:\WINDOWS\system32\XpsSvcs.dll 2007-03-23 04:07:54 583,504 ------w C:\WINDOWS\system32\XPSSHHDR.dll 2007-03-22 18:25:02 124,928 ------w C:\WINDOWS\system32\prntvpt.dll 2007-03-21 20:57:31 2,560 ------w C:\WINDOWS_MSRSTRT.EXE 2007-03-17 13:45:36 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-16 11:36:53 2,560 ------w C:\WINDOWS\system32\BitCometRes.dll 2007-03-11 21:12:56 -------- d-----w C:\Program Files\Reference Assemblies 2007-03-11 15:21:49 -------- d-----w C:\Program Files\NeoSmart Technologies 2007-03-10 16:32:51 -------- d-----w C:\Program Files\Microsoft.NET 2007-03-09 14:58:40 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\uTorrent 2007-03-09 12:02:21 -------- d-----w C:\Program Files\Common Files\Astonsoft 2007-03-08 19:44:19 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\DeepBurner Pro 2007-03-08 17:22:52 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\GSplit 2007-03-08 17:22:34 -------- d-----w C:\Program Files\Google 2007-03-08 17:18:05 -------- d-----w C:\Program Files\NCH Swift Sound 2007-03-08 17:18:05 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\NCH Swift Sound 2007-03-08 17:08:02 -------- d-----w C:\Program Files\Ashampoo 2007-03-08 16:51:22 21,120 ------w C:\WINDOWS\system32\drivers\nchssvad.sys 2007-03-08 15:38:47 579,072 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:38:47 40,960 ------w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:38:47 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:37:33 1,843,840 ------w C:\WINDOWS\system32\win32k.sys 2007-02-05 20:19:48 185,856 ------w C:\WINDOWS\system32\upnphost.dll 2006-12-17 14:22:43 2,516 --sh–w C:\WINDOWS\system32\KGyGaAvL.sys (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {0edc6c20-a31c-11db-8ab9-0800200c9a66}=C:\WINDOWS\system32\capicomb.dll [] {1E8A6170-7264-4D0F-BEAE-D42A53123C75}=C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll [2006-09-06 08:18] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}=D:\Programy\Scąganie z netu\BitComet\tools\BitCometBHO_1.1.2.7.dll [] {72853161-30C5-4D22-B7F9-0BBC1D38A37E}=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 01:48] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [2006-12-15 03:23] {85F685C3-20D9-4943-95E4-EB4224056C3F}=E:\odtwarzacz z napis\Expressivo Demo\IH_iexplore.dll [2006-12-13 14:40] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 10:50] “osCheck”=“C:\Program Files\Norton Internet Security\osCheck.exe” [2006-09-06 04:22] “ccApp”=“C:\Program Files\Common Files\Symantec Shared\ccApp.exe” [2007-01-09 22:59] “!AVG Anti-Spyware”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” [2006-10-07 14:20] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 14:00] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-03-23 13:52] “WMPNSCFG”=“C:\Program Files\Windows Media Player\WMPNSCFG.exe” [2006-12-01 12:46] “Expressivo”=“E:\odtwarzacz z napis\Expressivo Demo\expressivo.exe” [2006-12-13 15:09] [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “PcSync”=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoLowDiskSpaceChecks”=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll” [2006-09-28 16:13] “{B5A7F190-DDA6-4420-B3BA-52453494E6CD}”=“C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [2006-10-27 01:48] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ATI CATALYST – pasek zadań.lnk] backup=C:\WINDOWS\pss\ATI CATALYST – pasek zadań.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Kalendarz XP.lnk] backup=C:\WINDOWS\pss\Kalendarz XP.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^NaturalColorLoad.lnk] backup=C:\WINDOWS\pss\NaturalColorLoad.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^oem-pl^Menu Start^Programy^Autostart^NaturalColorLoad.lnk] backup=C:\WINDOWS\pss\NaturalColorLoad.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^oem-pl^Menu Start^Programy^Autostart^UniSpiker-2.6.lnk] backup=C:\WINDOWS\pss\UniSpiker-2.6.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] “C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CamTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1045 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] “C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HydraVisionViewPort] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LClock] C:\Program Files\LClock\LClock.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger] MSMSGS [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ] “C:\PROGRA~1\Ahead\NEROBA~1\NBJ.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RocketDock] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SeaMonkey Quick Launch] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Styler] C:\Program Files\Styler\Styler.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] “C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue SpyEraser] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive] “C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe” /s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe *Newly Created Service* -COMHOST Contents of the ‘Scheduled Tasks’ folder 2006-12-06 15:56:54 C:\WINDOWS\tasks\Idle Time Backup.job 2007-05-26 15:47:04 C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - oem-pl.job 2007-05-20 11:28:17 C:\WINDOWS\tasks\Uniblue SpyEraser Nag.job 2007-05-19 18:20:23 C:\WINDOWS\tasks\Uniblue SpyEraser.job ******************************************************************** catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-26 21:00:38 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ******************************************************************** Completion time: 2007-05-26 21:01:10 C:\ComboFix-quarantined-files.txt … 2007-05-26 21:01 C:\ComboFix2.txt … 2007-05-26 19:40 C:\ComboFix3.txt … 2007-05-25 20:19 — E O F —

Joan · 26 Maj 2007 20:04

Pobierz i uruchom narzędzie The Avenger Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Klikasz Done , a następnie zielone światełko i zgadzasz się na restart klikając OK.

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt

daj też nowe logi hjt + silentrunners

wozek53 · 27 Maj 2007 07:58

Wszystko wykonałem według poleceń. Dziękuję za pomoc. Raport avanger: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\sklxkxhy ******************* Script file located at: ??\C:\WINDOWS\kcjjyraq.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\system32\actxprxya.dll deleted successfully. File C:\WINDOWS\system32\bbafadcf4_s.dll deleted successfully. File C:\WINDOWS\g2806421.exe deleted successfully. File C:\WINDOWS\g1485031.exe deleted successfully. File C:\WINDOWS\g164625.exe deleted successfully. File C:\WINDOWS\system32\efhkj.ini2 deleted successfully. File C:\WINDOWS\system32\efhkj.bak2 deleted successfully. File C:\WINDOWS\system32\efhkj.bak1 deleted successfully. File C:\WINDOWS\system32\capicomb.dll not found! Deletion of file C:\WINDOWS\system32\capicomb.dll failed! Could not process line: C:\WINDOWS\system32\capicomb.dll Status: 0xc0000034 Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{0edc6c20-a31c-11db-8ab9-0800200c9a66} deleted successfully. Completed script processing. ******************* Finished! Terminate. Logi: Logfile of HijackThis v1.99.1 Scan saved at 09:50:14, on 2007-05-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16441) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\oem-pl\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Programy\Scąganie z netu\BitComet\tools\BitCometBHO_1.1.2.7.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - E:\odtwarzacz z napis\Expressivo Demo\IH_iexplore.dll O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - E:\odtwarzacz z napis\Expressivo Demo\IH_iexplore.dll O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [osCheck] “C:\Program Files\Norton Internet Security\osCheck.exe” O4 - HKLM…\Run: [ccApp] “C:\Program Files\Common Files\Symantec Shared\ccApp.exe” O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O8 - Extra context menu item: Download all links using BitComet - res://D:\Programy\Scąganie z netu\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://D:\Programy\Scąganie z netu\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://D:\Programy\Scąganie z netu\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra ‘Tools’ menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/ … 586-jc.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Usługa Auto-Protect programu Norton AntiVirus (navapsvc) - Unknown owner - C:\Program Files\Norton AntiVirus\navapsvc.exe (file missing) O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe “Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “ctfmon.exe” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “Skype” = ““C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”] “WMPNSCFG” = “C:\Program Files\Windows Media Player\WMPNSCFG.exe” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “osCheck” = ““C:\Program Files\Norton Internet Security\osCheck.exe”” [“Symantec Corporation”] “ccApp” = ““C:\Program Files\Common Files\Symantec Shared\ccApp.exe”” [“Symantec Corporation”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “Adobe PDF Reader Link Helper” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {1E8A6170-7264-4D0F-BEAE-D42A53123C75}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll” [“Symantec Corporation”] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}(Default) = “BitComet ClickCapture” -> {HKLM…CLSID} = “BitComet Helper” \InProcServer32(Default) = “D:\Programy\Scąganie z netu\BitComet\tools\BitCometBHO_1.1.2.7.dll” [“BitComet”] {72853161-30C5-4D22-B7F9-0BBC1D38A37E}(Default) = (no title provided) -> {HKLM…CLSID} = “Groove GFS Browser Helper” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll” [“Sun Microsystems, Inc.”] {85F685C3-20D9-4943-95E4-EB4224056C3F}(Default) = (no title provided) -> {HKLM…CLSID} = “Expressivo” \InProcServer32(Default) = “E:\odtwarzacz z napis\Expressivo Demo\IH_iexplore.dll” [“IVO Software Sp. z o.o.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{FF393560-C2A7-11CF-BFF4-444553540000}” = “History” -> {HKCU…CLSID} = “History” \InProcServer32(Default) = “C:\WINDOWS\system32\ieframe.dll” [MS] “{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}” = “The Internet” -> {HKCU…CLSID} = “The Internet” \InProcServer32(Default) = “C:\WINDOWS\system32\ieframe.dll” [MS] “{88C6C381-2E85-11D0-94DE-444553540000}” = “ActiveX Cache Folder” -> {HKCU…CLSID} = “ActiveX Cache Folder” \InProcServer32(Default) = “C:\WINDOWS\system32\occache.dll” [MS] “{F5175861-2688-11d0-9C5E-00AA00A45957}” = “Subscription Folder” -> {HKCU…CLSID} = “Subscription Folder” \InProcServer32(Default) = “C:\WINDOWS\system32\webcheck.dll” [MS] “{5E2121EE-0300-11D4-8D3B-444553540000}” = “Catalyst Context Menu extension” -> {HKLM…CLSID} = “SimpleShlExt Class” \InProcServer32(Default) = “C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll” [empty string] “{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}” = “Shell Extensions for RealOne Player” -> {HKLM…CLSID} = “RealOne Player Context Menu Class” \InProcServer32(Default) = “C:\Program Files\Real\RealPlayer\rpshell.dll” [“RealNetworks, Inc.”] “{e57ce731-33e8-4c51-8354-bb4de9d215d1}” = “Uniwersalne urządzenia Plug and Play” -> {HKLM…CLSID} = “Uniwersalne urządzenia Plug and Play” \InProcServer32(Default) = “C:\WINDOWS\system32\upnpui.dll” [MS] “{23170F69-40C1-278A-1000-000100020000}” = “7-Zip Shell Extension” -> {HKLM…CLSID} = “7-Zip Shell Extension” \InProcServer32(Default) = “C:\Program Files\7-Zip\7-zip.dll” [“Igor Pavlov”] “{B7056B8E-4F99-44f8-8CBD-282390FE5428}” = “VirtualCloneDrive” -> {HKLM…CLSID} = “VirtualCloneDrive Shell Extension” \InProcServer32(Default) = “C:\Program Files\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll” [“Elaborate Bytes AG”] “{72853161-30C5-4D22-B7F9-0BBC1D38A37E}” = “Groove GFS Browser Helper” -> {HKLM…CLSID} = “Groove GFS Browser Helper” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}” = “Groove GFS Explorer Bar” -> {HKLM…CLSID} = “Groove Folder Synchronization” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{A449600E-1DC6-4232-B948-9BD794D62056}” = “Groove GFS Stub Icon Handler” -> {HKLM…CLSID} = “Groove GFS Stub Icon Handler” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{B5A7F190-DDA6-4420-B3BA-52453494E6CD}” = “Groove GFS Stub Execution Hook” -> {HKLM…CLSID} = “Groove GFS Stub Execution Hook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{6C467336-8281-4E60-8204-430CED96822D}” = “Groove GFS Context Menu Handler” -> {HKLM…CLSID} = “Groove GFS Context Menu Handler” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{387E725D-DC16-4D76-B310-2C93ED4752A0}” = “Groove XML Icon Handler” -> {HKLM…CLSID} = “Groove XML Icon Handler” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{16F3DD56-1AF5-4347-846D-7C10C4192619}” = “Groove Explorer Icon Overlay 3 (GFS Folder)” -> {HKLM…CLSID} = “Groove Explorer Icon Overlay 3 (GFS Folder)” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}” = “Groove Explorer Icon Overlay 2 (GFS Stub)” -> {HKLM…CLSID} = “Groove Explorer Icon Overlay 2 (GFS Stub)” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}” = “Groove Explorer Icon Overlay 4 (GFS Unread Mark)” -> {HKLM…CLSID} = “Groove Explorer Icon Overlay 4 (GFS Unread Mark)” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{99FD978C-D287-4F50-827F-B2C658EDA8E7}” = “Groove Explorer Icon Overlay 1 (GFS Unread Stub)” -> {HKLM…CLSID} = “Groove Explorer Icon Overlay 1 (GFS Unread Stub)” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{920E6DB1-9907-4370-B3A0-BAFC03D81399}” = “Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)” -> {HKLM…CLSID} = “Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Outlook File Icon Extension” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL” [MS] “{00020D75-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Desktop Icon Handler” -> {HKLM…CLSID} = “Microsoft Office Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL” [MS] “{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}” = “Microsoft Office OneNote Namespace Extension for Windows Desktop Search” -> {HKLM…CLSID} = “Microsoft Office OneNote Namespace Extension for Windows Desktop Search” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office12\msohevi.dll” [MS] “{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}” = “Microsoft Office Metadata Handler” -> {HKLM…CLSID} = “Microsoft Office Metadata Handler” \InProcServer32(Default) = “C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll” [MS] “{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}” = “Microsoft Office Thumbnail Handler” -> {HKLM…CLSID} = “Microsoft Office Thumbnail Handler” \InProcServer32(Default) = “C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll” [MS] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}” = “PhoneBrowser” -> {HKLM…CLSID} = “Nokia Phone Browser” \InProcServer32(Default) = “C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll” [“Nokia”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}” = “AVG Anti-Spyware 7.5” -> {HKLM…CLSID} = “CShellExecuteHookImpl Object” \InProcServer32(Default) = “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll” [“Anti-Malware Development a.s.”] <> “{B5A7F190-DDA6-4420-B3BA-52453494E6CD}” = “Groove GFS Stub Execution Hook” -> {HKLM…CLSID} = “Groove GFS Stub Execution Hook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “WPDShServiceObj” = “{AAA288BA-9A4C-45B0-95D7-94D524869DB5}” -> {HKLM…CLSID} = “WPDShServiceObj Class” \InProcServer32(Default) = “C:\WINDOWS\system32\WPDShServiceObj.dll” [MS] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807563E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = “Microsoft Office InfoPath XML Mime Filter” \InProcServer32(Default) = “C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ 7-Zip(Default) = “{23170F69-40C1-278A-1000-000100020000}” -> {HKLM…CLSID} = “7-Zip Shell Extension” \InProcServer32(Default) = “C:\Program Files\7-Zip\7-zip.dll” [“Igor Pavlov”] AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] Symantec.Norton.Antivirus.IEContextMenu(Default) = “{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}” -> {HKLM…CLSID} = “IEContextMenu Class” \InProcServer32(Default) = “C:\PROGRA~1\NORTON~1\NORTON~1\NavShExt.dll” [“Symantec Corporation”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] XXX Groove GFS Context Menu Handler XXX(Default) = “{6C467336-8281-4E60-8204-430CED96822D}” -> {HKLM…CLSID} = “Groove GFS Context Menu Handler” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip(Default) = “{23170F69-40C1-278A-1000-000100020000}” -> {HKLM…CLSID} = “7-Zip Shell Extension” \InProcServer32(Default) = “C:\Program Files\7-Zip\7-zip.dll” [“Igor Pavlov”] AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] XXX Groove GFS Context Menu Handler XXX(Default) = “{6C467336-8281-4E60-8204-430CED96822D}” -> {HKLM…CLSID} = “Groove GFS Context Menu Handler” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Symantec.Norton.Antivirus.IEContextMenu(Default) = “{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}” -> {HKLM…CLSID} = “IEContextMenu Class” \InProcServer32(Default) = “C:\PROGRA~1\NORTON~1\NORTON~1\NavShExt.dll” [“Symantec Corporation”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] XXX Groove GFS Context Menu Handler XXX(Default) = “{6C467336-8281-4E60-8204-430CED96822D}” -> {HKLM…CLSID} = “Groove GFS Context Menu Handler” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ XXX Groove GFS Context Menu Handler XXX(Default) = “{6C467336-8281-4E60-8204-430CED96822D}” -> {HKLM…CLSID} = “Groove GFS Context Menu Handler” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoLowDiskSpaceChecks” = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoCDBurning” = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “DisableRegistryTools” = (REG_DWORD) hex:0x00000000 {Prevent access to registry editing tools} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\oem-pl\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Scheduled Tasks: ------------------------ “Idle Time Backup” -> launches: “F:\Backup\itbackup.exe /n” [file not found] “Norton Internet Security - Run Full System Scan - oem-pl” -> launches: “C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe /TASK:“C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Norton AntiVirus\Tasks\mycomp.sca”” [“Symantec Corporation”] “Uniblue SpyEraser Nag” -> launches: “C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe -ynag” [file not found] “Uniblue SpyEraser” -> launches: “C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe -s” [file not found] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{F2CF5485-4E02-4F68-819C-B92DE9277049}” -> {HKLM…CLSID} = “&Links” \InProcServer32(Default) = “C:\WINDOWS\system32\ieframe.dll” [MS] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{90222687-F593-4738-B738-FBEE9C7B26DF}” = “NCO Toolbar” -> {HKLM…CLSID} = “Show Norton Toolbar” \InProcServer32(Default) = “C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll” [“Symantec Corporation”] “{85F685C3-20D9-4943-95E4-EB4224056C3F}” = “Expressivo” -> {HKLM…CLSID} = “Expressivo” \InProcServer32(Default) = “E:\odtwarzacz z napis\Expressivo Demo\IH_iexplore.dll” [“IVO Software Sp. z o.o.”] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}(Default) = “Groove Folder Synchronization” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [MS] HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Poszukaj” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in 1.5.0_11” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.5.0_11” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll” [“Sun Microsystems, Inc.”] {2670000A-7350-4F3C-8081-5663EE0C6C49}\ “ButtonText” = “Wyślij do programu OneNote” “MenuText” = “Wyślij &do programu OneNote” “CLSIDExtension” = “{48E73304-E1D6-4330-914C-F5F514E3486C}” -> {HKLM…CLSID} = “Send to OneNote from Internet Explorer button” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll” [MS] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Research” {E2E2DD38-D088-4134-82B7-F2BA38496583}\ “MenuText” = “@xpsp3res.dll,-20001” “Exec” = “%windir%\Network Diagnostic\xpnetdiag.exe” [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\system32\Ati2evxx.exe” [“ATI Technologies Inc.”] Automatic LiveUpdate Scheduler, Automatic LiveUpdate Scheduler, ““C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe”” [“Symantec Corporation”] AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe” [“Anti-Malware Development a.s.”] Machine Debug Manager, MDM, ““C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE”” [MS] Symantec AppCore Service, SymAppCore, ““C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe”” [“Symantec Corporation”] Symantec Event Manager, ccEvtMgr, ““C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe” /h ccCommon” [“Symantec Corporation”] Symantec Lic NetConnect service, CLTNetCnService, ““C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe” /h ccCommon” [“Symantec Corporation”] Symantec Settings Manager, ccSetMgr, ““C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe” /h ccCommon” [“Symantec Corporation”] Windows Driver Foundation - User-mode Driver Framework, WudfSvc, “C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup” {“C:\WINDOWS\System32\WUDFSvc.dll” [MS]} Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Shared Fax Monitor\Driver = “FXSMON.DLL” [MS] Send To Microsoft OneNote Monitor\Driver = “msonpmon.dll” [MS] SUGS1 Langmon\Driver = “SUGS1LMK.DLL” [“Samsung Electronics.”] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 62 seconds, including 10 seconds for message boxes)

Joan · 27 Maj 2007 08:05

Start > Wszystkie programy > Akcesoria > Narzędzia systemowe > Zaplanowane zadania i usuń “Idle Time Backup”, “Uniblue SpyEraser Nag”,

"Uniblue SpyEraser"

wozek53 · 27 Maj 2007 08:26

Joan · 27 Maj 2007 08:47

już wszystko powinno być ok, daj jeszcze loga z combo na wszelki wypadek

wozek53 · 27 Maj 2007 12:38

Podczas tworzenia logo combo wyskoczył komunikat: “Wystąpił problem z aplikacją cetchmo.cfexe:zostanie ona zamknięta. Przepraszamy za kłopoty.” log: “oem-pl” - 2007-05-27 14:11:43 Dodatek Service Pack 2 ComboFix 07-05.21.6.V - Running from: “E:\Generowanie logo Hijack” ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-27 )))))))))))))))))))))))))))))))))) 2007-05-27 09:43 2007-05-23 09:09 1,300 --a------ C:\WINDOWS\system32\tmp.reg 2007-05-22 10:00 2007-05-21 18:59 2007-05-21 18:59 2007-05-21 18:54 7,287,808 --a------ C:\WINDOWS\system32\vistaui.exe 2007-05-21 18:54 414,009 --a------ C:\WINDOWS\system32\vimc.exe 2007-05-21 18:54 2007-05-21 18:54 2007-05-21 18:54 2007-05-21 18:54 2007-05-21 18:54 2007-05-21 18:50 2007-05-21 18:32 2007-05-21 10:18 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-05-20 16:29 81,920 --a------ C:\WINDOWS\system32\closeapp.exe 2007-05-20 16:29 8,636 --a------ C:\WINDOWS\system32\modifype.exe 2007-05-20 16:29 19,968 --a------ C:\WINDOWS\system32\reico.exe 2007-05-20 16:29 2007-05-20 16:21 2007-05-20 16:03 38,643 --a------ C:\WINDOWS\BricoPackUninst.cmd 2007-05-20 16:01 2,155 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd 2007-05-20 16:00 2007-05-19 16:17 2007-05-18 18:32 2007-05-18 16:53 2007-05-18 10:42 2007-05-17 19:55 2007-05-15 18:09 2007-05-14 20:58 2007-05-14 20:58 2007-05-12 16:00 2007-05-09 19:54 2007-05-08 20:29 2007-05-08 17:59 2007-05-05 10:49 24,512 --------- C:\WINDOWS\system32\drivers\VBoxDrv.sys 2007-05-05 10:49 18,720 --------- C:\WINDOWS\system32\drivers\VBoxUSBFlt.sys 2007-05-02 18:41 2007-05-01 17:56 2007-05-01 17:55 2007-05-01 17:54 2007-05-01 15:03 22,112 -r------- C:\WINDOWS\system32\drivers\COH_Mon.sys 2007-05-01 14:28 8,704 --a------ C:\WINDOWS\system32\fxsperf.dll 2007-05-01 14:28 72,192 --a------ C:\WINDOWS\system32\fxscom.dll 2007-05-01 14:28 7,168 --a------ C:\WINDOWS\system32\fxsres.dll 2007-05-01 14:28 58,880 --a------ C:\WINDOWS\system32\fxsevent.dll 2007-05-01 14:28 562,688 --a------ C:\WINDOWS\system32\fxsst.dll 2007-05-01 14:28 452,096 --a------ C:\WINDOWS\system32\fxsapi.dll 2007-05-01 14:28 400,896 --a------ C:\WINDOWS\system32\fxsxp32.dll 2007-05-01 14:28 397,312 --a------ C:\WINDOWS\system32\fxstiff.dll 2007-05-01 14:28 31,744 --a------ C:\WINDOWS\system32\fxsroute.dll 2007-05-01 14:28 285,184 --a------ C:\WINDOWS\system32\fxscomex.dll 2007-05-01 14:28 27,136 --a------ C:\WINDOWS\system32\fxsdrv.dll 2007-05-01 14:28 268,288 --a------ C:\WINDOWS\system32\fxssvc.exe 2007-05-01 14:28 246,272 --a------ C:\WINDOWS\system32\fxst30.dll 2007-05-01 14:28 233,472 --a------ C:\WINDOWS\system32\fxscover.exe 2007-05-01 14:28 23,552 --a------ C:\WINDOWS\system32\fxsmon.dll 2007-05-01 14:28 23,552 --a------ C:\WINDOWS\system32\fxsext32.dll 2007-05-01 14:28 194,560 --a------ C:\WINDOWS\system32\fxswzrd.dll 2007-05-01 14:28 155,648 --a------ C:\WINDOWS\system32\fxsui.dll 2007-05-01 14:28 143,360 --a------ C:\WINDOWS\system32\fxsclnt.exe 2007-05-01 14:28 137,728 --a------ C:\WINDOWS\system32\fxsclntR.dll 2007-05-01 14:28 112,128 --a------ C:\WINDOWS\system32\fxscfgwz.dll 2007-05-01 14:28 11,264 --a------ C:\WINDOWS\system32\fxssend.exe 2007-05-01 14:28 2007-04-28 15:24 51,200 --------- C:\WINDOWS\system32\dumphive.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-27 11:59:09 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Skype 2007-05-27 07:22:03 -------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-05-21 17:02:35 89,190 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-05-21 17:02:35 499,364 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-05-10 10:58:06 -------- d-----w C:\Program Files\IE7pro 2007-05-02 18:44:59 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Ashampoo 2007-05-01 15:56:14 -------- d-----w C:\Program Files\Common Files\Real 2007-04-29 13:37:14 -------- d-----w C:\Program Files\ATITool 2007-04-23 08:05:14 100,482 ------w C:\WINDOWS\UninstallThunderbird.exe 2007-04-23 08:05:08 15,749 ------w C:\WINDOWS\mozver.dat 2007-04-21 14:07:13 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Media Player Classic 2007-04-20 17:10:44 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Nokia 2007-04-20 16:28:38 -------- d-----w C:\Program Files\DAEMON Tools 2007-04-20 15:41:55 682,232 ------w C:\WINDOWS\system32\drivers\sptd.sys 2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-04-16 20:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-04-16 20:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll 2007-04-11 10:07:44 -------- d-----w C:\Program Files\IrfanView 2007-04-08 13:02:52 -------- d-----w C:\Program Files\Odkurzacz 2007-04-07 13:54:30 -------- d-----w C:\Program Files\Norton Internet Security 2007-04-01 18:32:57 -------- d-----w C:\Program Files\Ahead 2007-03-31 13:31:23 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-03-28 21:26:48 -------- d-----w C:\Program Files\Skype 2007-03-28 21:26:47 -------- d-----w C:\Program Files\Common Files\Skype 2007-03-26 14:53:13 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Creative 2007-03-26 14:51:48 -------- d-----w C:\Program Files\Creative 2007-03-25 19:21:39 223,128 ------w C:\WINDOWS\system32\drivers\vaxscsi.sys 2007-03-25 17:38:54 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Nokia Multimedia Player 2007-03-25 17:28:47 -------- d-----w C:\Program Files\Common Files\PCSuite 2007-03-25 17:28:43 -------- d-----w C:\Program Files\Common Files\Nokia 2007-03-25 17:28:42 -------- d-----w C:\Program Files\Nokia 2007-03-25 14:50:24 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\PC Suite 2007-03-25 14:49:32 -------- d-----w C:\Program Files\DIFX 2007-03-23 04:07:56 1,683,280 ------w C:\WINDOWS\system32\XpsSvcs.dll 2007-03-23 04:07:54 583,504 ------w C:\WINDOWS\system32\XPSSHHDR.dll 2007-03-22 18:25:02 124,928 ------w C:\WINDOWS\system32\prntvpt.dll 2007-03-21 20:57:31 2,560 ------w C:\WINDOWS_MSRSTRT.EXE 2007-03-17 13:45:36 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-16 11:36:53 2,560 ------w C:\WINDOWS\system32\BitCometRes.dll 2007-03-11 21:12:56 -------- d-----w C:\Program Files\Reference Assemblies 2007-03-11 15:21:49 -------- d-----w C:\Program Files\NeoSmart Technologies 2007-03-10 16:32:51 -------- d-----w C:\Program Files\Microsoft.NET 2007-03-09 14:58:40 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\uTorrent 2007-03-09 12:02:21 -------- d-----w C:\Program Files\Common Files\Astonsoft 2007-03-08 19:44:19 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\DeepBurner Pro 2007-03-08 17:22:52 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\GSplit 2007-03-08 17:22:34 -------- d-----w C:\Program Files\Google 2007-03-08 17:18:05 -------- d-----w C:\Program Files\NCH Swift Sound 2007-03-08 17:18:05 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\NCH Swift Sound 2007-03-08 17:08:02 -------- d-----w C:\Program Files\Ashampoo 2007-03-08 16:51:22 21,120 ------w C:\WINDOWS\system32\drivers\nchssvad.sys 2007-03-08 15:38:47 579,072 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:38:47 40,960 ------w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:38:47 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:37:33 1,843,840 ------w C:\WINDOWS\system32\win32k.sys 2007-02-05 20:19:48 185,856 ------w C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {1E8A6170-7264-4D0F-BEAE-D42A53123C75}=C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll [2006-09-06 08:18] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}=D:\Programy\Scąganie z netu\BitComet\tools\BitCometBHO_1.1.2.7.dll [] {72853161-30C5-4D22-B7F9-0BBC1D38A37E}=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 01:48] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [2006-12-15 03:23] {85F685C3-20D9-4943-95E4-EB4224056C3F}=E:\odtwarzacz z napis\Expressivo Demo\IH_iexplore.dll [2006-12-13 14:40] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 10:50] “osCheck”=“C:\Program Files\Norton Internet Security\osCheck.exe” [2006-09-06 04:22] “ccApp”=“C:\Program Files\Common Files\Symantec Shared\ccApp.exe” [2007-01-09 22:59] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 14:00] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-03-23 13:52] “WMPNSCFG”=“C:\Program Files\Windows Media Player\WMPNSCFG.exe” [2006-12-01 12:46] [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “PcSync”=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] “NoCDBurning”=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoLowDiskSpaceChecks”=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll” [2006-09-28 16:13] “{B5A7F190-DDA6-4420-B3BA-52453494E6CD}”=“C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [2006-10-27 01:48] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ATI CATALYST – pasek zadań.lnk] backup=C:\WINDOWS\pss\ATI CATALYST – pasek zadań.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Kalendarz XP.lnk] backup=C:\WINDOWS\pss\Kalendarz XP.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^NaturalColorLoad.lnk] backup=C:\WINDOWS\pss\NaturalColorLoad.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^oem-pl^Menu Start^Programy^Autostart^NaturalColorLoad.lnk] backup=C:\WINDOWS\pss\NaturalColorLoad.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^oem-pl^Menu Start^Programy^Autostart^UniSpiker-2.6.lnk] backup=C:\WINDOWS\pss\UniSpiker-2.6.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg!AVG Anti-Spyware] “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] “C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CamTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1045 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] “C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HydraVisionViewPort] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LClock] C:\Program Files\LClock\LClock.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger] MSMSGS [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ] “C:\PROGRA~1\Ahead\NEROBA~1\NBJ.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RocketDock] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SeaMonkey Quick Launch] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Styler] C:\Program Files\Styler\Styler.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] “C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue SpyEraser] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive] “C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe” /s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe *Newly Created Service* -COMHOST Contents of the ‘Scheduled Tasks’ folder 2007-05-26 15:47:04 C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - oem-pl.job ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-27 14:13:31 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … ******************************************************************** Completion time: 2007-05-27 14:16:25 — E O F —

Złączono Posta : 27.05.2007 (Nie) 14:39

Podczas tworzenia logo combo wyskoczył komunikat: “Wystąpił problem z aplikacją cetchmo.cfexe:zostanie ona zamknięta. Przepraszamy za kłopoty.” log: “oem-pl” - 2007-05-27 14:11:43 Dodatek Service Pack 2 ComboFix 07-05.21.6.V - Running from: “E:\Generowanie logo Hijack” ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-27 )))))))))))))))))))))))))))))))))) 2007-05-27 09:43 2007-05-23 09:09 1,300 --a------ C:\WINDOWS\system32\tmp.reg 2007-05-22 10:00 2007-05-21 18:59 2007-05-21 18:59 2007-05-21 18:54 7,287,808 --a------ C:\WINDOWS\system32\vistaui.exe 2007-05-21 18:54 414,009 --a------ C:\WINDOWS\system32\vimc.exe 2007-05-21 18:54 2007-05-21 18:54 2007-05-21 18:54 2007-05-21 18:54 2007-05-21 18:54 2007-05-21 18:50 2007-05-21 18:32 2007-05-21 10:18 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-05-20 16:29 81,920 --a------ C:\WINDOWS\system32\closeapp.exe 2007-05-20 16:29 8,636 --a------ C:\WINDOWS\system32\modifype.exe 2007-05-20 16:29 19,968 --a------ C:\WINDOWS\system32\reico.exe 2007-05-20 16:29 2007-05-20 16:21 2007-05-20 16:03 38,643 --a------ C:\WINDOWS\BricoPackUninst.cmd 2007-05-20 16:01 2,155 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd 2007-05-20 16:00 2007-05-19 16:17 2007-05-18 18:32 2007-05-18 16:53 2007-05-18 10:42 2007-05-17 19:55 2007-05-15 18:09 2007-05-14 20:58 2007-05-14 20:58 2007-05-12 16:00 2007-05-09 19:54 2007-05-08 20:29 2007-05-08 17:59 2007-05-05 10:49 24,512 --------- C:\WINDOWS\system32\drivers\VBoxDrv.sys 2007-05-05 10:49 18,720 --------- C:\WINDOWS\system32\drivers\VBoxUSBFlt.sys 2007-05-02 18:41 2007-05-01 17:56 2007-05-01 17:55 2007-05-01 17:54 2007-05-01 15:03 22,112 -r------- C:\WINDOWS\system32\drivers\COH_Mon.sys 2007-05-01 14:28 8,704 --a------ C:\WINDOWS\system32\fxsperf.dll 2007-05-01 14:28 72,192 --a------ C:\WINDOWS\system32\fxscom.dll 2007-05-01 14:28 7,168 --a------ C:\WINDOWS\system32\fxsres.dll 2007-05-01 14:28 58,880 --a------ C:\WINDOWS\system32\fxsevent.dll 2007-05-01 14:28 562,688 --a------ C:\WINDOWS\system32\fxsst.dll 2007-05-01 14:28 452,096 --a------ C:\WINDOWS\system32\fxsapi.dll 2007-05-01 14:28 400,896 --a------ C:\WINDOWS\system32\fxsxp32.dll 2007-05-01 14:28 397,312 --a------ C:\WINDOWS\system32\fxstiff.dll 2007-05-01 14:28 31,744 --a------ C:\WINDOWS\system32\fxsroute.dll 2007-05-01 14:28 285,184 --a------ C:\WINDOWS\system32\fxscomex.dll 2007-05-01 14:28 27,136 --a------ C:\WINDOWS\system32\fxsdrv.dll 2007-05-01 14:28 268,288 --a------ C:\WINDOWS\system32\fxssvc.exe 2007-05-01 14:28 246,272 --a------ C:\WINDOWS\system32\fxst30.dll 2007-05-01 14:28 233,472 --a------ C:\WINDOWS\system32\fxscover.exe 2007-05-01 14:28 23,552 --a------ C:\WINDOWS\system32\fxsmon.dll 2007-05-01 14:28 23,552 --a------ C:\WINDOWS\system32\fxsext32.dll 2007-05-01 14:28 194,560 --a------ C:\WINDOWS\system32\fxswzrd.dll 2007-05-01 14:28 155,648 --a------ C:\WINDOWS\system32\fxsui.dll 2007-05-01 14:28 143,360 --a------ C:\WINDOWS\system32\fxsclnt.exe 2007-05-01 14:28 137,728 --a------ C:\WINDOWS\system32\fxsclntR.dll 2007-05-01 14:28 112,128 --a------ C:\WINDOWS\system32\fxscfgwz.dll 2007-05-01 14:28 11,264 --a------ C:\WINDOWS\system32\fxssend.exe 2007-05-01 14:28 2007-04-28 15:24 51,200 --------- C:\WINDOWS\system32\dumphive.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-27 11:59:09 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Skype 2007-05-27 07:22:03 -------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-05-21 17:02:35 89,190 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-05-21 17:02:35 499,364 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-05-10 10:58:06 -------- d-----w C:\Program Files\IE7pro 2007-05-02 18:44:59 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Ashampoo 2007-05-01 15:56:14 -------- d-----w C:\Program Files\Common Files\Real 2007-04-29 13:37:14 -------- d-----w C:\Program Files\ATITool 2007-04-23 08:05:14 100,482 ------w C:\WINDOWS\UninstallThunderbird.exe 2007-04-23 08:05:08 15,749 ------w C:\WINDOWS\mozver.dat 2007-04-21 14:07:13 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Media Player Classic 2007-04-20 17:10:44 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Nokia 2007-04-20 16:28:38 -------- d-----w C:\Program Files\DAEMON Tools 2007-04-20 15:41:55 682,232 ------w C:\WINDOWS\system32\drivers\sptd.sys 2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-04-16 20:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-04-16 20:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll 2007-04-11 10:07:44 -------- d-----w C:\Program Files\IrfanView 2007-04-08 13:02:52 -------- d-----w C:\Program Files\Odkurzacz 2007-04-07 13:54:30 -------- d-----w C:\Program Files\Norton Internet Security 2007-04-01 18:32:57 -------- d-----w C:\Program Files\Ahead 2007-03-31 13:31:23 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-03-28 21:26:48 -------- d-----w C:\Program Files\Skype 2007-03-28 21:26:47 -------- d-----w C:\Program Files\Common Files\Skype 2007-03-26 14:53:13 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Creative 2007-03-26 14:51:48 -------- d-----w C:\Program Files\Creative 2007-03-25 19:21:39 223,128 ------w C:\WINDOWS\system32\drivers\vaxscsi.sys 2007-03-25 17:38:54 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\Nokia Multimedia Player 2007-03-25 17:28:47 -------- d-----w C:\Program Files\Common Files\PCSuite 2007-03-25 17:28:43 -------- d-----w C:\Program Files\Common Files\Nokia 2007-03-25 17:28:42 -------- d-----w C:\Program Files\Nokia 2007-03-25 14:50:24 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\PC Suite 2007-03-25 14:49:32 -------- d-----w C:\Program Files\DIFX 2007-03-23 04:07:56 1,683,280 ------w C:\WINDOWS\system32\XpsSvcs.dll 2007-03-23 04:07:54 583,504 ------w C:\WINDOWS\system32\XPSSHHDR.dll 2007-03-22 18:25:02 124,928 ------w C:\WINDOWS\system32\prntvpt.dll 2007-03-21 20:57:31 2,560 ------w C:\WINDOWS_MSRSTRT.EXE 2007-03-17 13:45:36 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-16 11:36:53 2,560 ------w C:\WINDOWS\system32\BitCometRes.dll 2007-03-11 21:12:56 -------- d-----w C:\Program Files\Reference Assemblies 2007-03-11 15:21:49 -------- d-----w C:\Program Files\NeoSmart Technologies 2007-03-10 16:32:51 -------- d-----w C:\Program Files\Microsoft.NET 2007-03-09 14:58:40 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\uTorrent 2007-03-09 12:02:21 -------- d-----w C:\Program Files\Common Files\Astonsoft 2007-03-08 19:44:19 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\DeepBurner Pro 2007-03-08 17:22:52 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\GSplit 2007-03-08 17:22:34 -------- d-----w C:\Program Files\Google 2007-03-08 17:18:05 -------- d-----w C:\Program Files\NCH Swift Sound 2007-03-08 17:18:05 -------- d-----w C:\DOCUME~1\oem-pl\DANEAP~1\NCH Swift Sound 2007-03-08 17:08:02 -------- d-----w C:\Program Files\Ashampoo 2007-03-08 16:51:22 21,120 ------w C:\WINDOWS\system32\drivers\nchssvad.sys 2007-03-08 15:38:47 579,072 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:38:47 40,960 ------w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:38:47 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:37:33 1,843,840 ------w C:\WINDOWS\system32\win32k.sys 2007-02-05 20:19:48 185,856 ------w C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {1E8A6170-7264-4D0F-BEAE-D42A53123C75}=C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll [2006-09-06 08:18] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}=D:\Programy\Scąganie z netu\BitComet\tools\BitCometBHO_1.1.2.7.dll [] {72853161-30C5-4D22-B7F9-0BBC1D38A37E}=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 01:48] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [2006-12-15 03:23] {85F685C3-20D9-4943-95E4-EB4224056C3F}=E:\odtwarzacz z napis\Expressivo Demo\IH_iexplore.dll [2006-12-13 14:40] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 10:50] “osCheck”=“C:\Program Files\Norton Internet Security\osCheck.exe” [2006-09-06 04:22] “ccApp”=“C:\Program Files\Common Files\Symantec Shared\ccApp.exe” [2007-01-09 22:59] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 14:00] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-03-23 13:52] “WMPNSCFG”=“C:\Program Files\Windows Media Player\WMPNSCFG.exe” [2006-12-01 12:46] [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “PcSync”=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] “NoCDBurning”=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoLowDiskSpaceChecks”=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll” [2006-09-28 16:13] “{B5A7F190-DDA6-4420-B3BA-52453494E6CD}”=“C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL” [2006-10-27 01:48] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ATI CATALYST – pasek zadań.lnk] backup=C:\WINDOWS\pss\ATI CATALYST – pasek zadań.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Kalendarz XP.lnk] backup=C:\WINDOWS\pss\Kalendarz XP.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^NaturalColorLoad.lnk] backup=C:\WINDOWS\pss\NaturalColorLoad.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^oem-pl^Menu Start^Programy^Autostart^NaturalColorLoad.lnk] backup=C:\WINDOWS\pss\NaturalColorLoad.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^oem-pl^Menu Start^Programy^Autostart^UniSpiker-2.6.lnk] backup=C:\WINDOWS\pss\UniSpiker-2.6.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg!AVG Anti-Spyware] “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] “C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CamTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1045 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] “C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HydraVisionViewPort] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LClock] C:\Program Files\LClock\LClock.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger] MSMSGS [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ] “C:\PROGRA~1\Ahead\NEROBA~1\NBJ.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RocketDock] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SeaMonkey Quick Launch] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Styler] C:\Program Files\Styler\Styler.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] “C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue SpyEraser] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive] “C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe” /s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe *Newly Created Service* -COMHOST Contents of the ‘Scheduled Tasks’ folder 2007-05-26 15:47:04 C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - oem-pl.job ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-27 14:13:31 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … ******************************************************************** Completion time: 2007-05-27 14:16:25 — E O F —

Joan · 27 Maj 2007 15:30

log ok

wozek53 · 27 Maj 2007 15:58