Virus alert - pełno syfu na moim pc

**Posty:** 358 · przez **Kemuel** 27 Wrz 2008, 10:35

Znowu duży problem , chyba kablówka zdjeła zabezpieczenia bo ostatnio często pojawiają się takie kłopoty u wszystkich posiadaczy internetu od mojego dystrybutora.
Na moim pojawia się koło zegara "Virus Alert !" i jakieś ikony na pulpicie "privacy protector" "erroe cleaner" "spyware&protection" a internet tak się muli że szok no i co chwilę wyskakuje jakaś strona z "Virus Remower2008" żeby go zainstalować a jak już zainstaluję to ładuje strone Quelle.
Skanowalem z awaryjnego SD-Fixem Qombofixem Hijackiem i nic nie pomogło. Pceta croni u mnie AVG najnowszy free i nic nie pomógł a jak zaczołem skanować to uruchamiały się te strony i różne komunikaty.
Czy pozostał mi tylko format????

**Posty:** 8001 · przez **Okocza** 27 Wrz 2008, 10:40

smitfraudfix z opcji 2
(sciagasz -> uruchamiasz-> klikasz dowolny klawisz -> wpisujesz w programie 2 i enter potem czekasz chwile -> gdy wyskoczy pytanie w programie Do you want to clean the registry ? to wpisujesz literke Y i znowu enter i czekasz do wyskoczenia raportu (znak ze skan dobiegł konca)

Kemuel napisał(a):Skanowalem z awaryjnego SD-Fixem Qombofixem Hijackiem

wstaw logi

**Posty:** 684 · przez **djarta** 27 Wrz 2008, 10:40

Daj nam logi z ComboFix, HJT i SDFix.

@okocza - SmitFraudFix jest tu wogóle nie potrzebny - wiem, że on usuwa ten rodzaj infekcji ale nie opłaca się go używać.

======================
K.

**Posty:** 358 · przez **Kemuel** 27 Wrz 2008, 10:46

ok zaraz przeskanuje na nowo i dam świeżutkie tylko nie wiem czy się uda wkleić bo co chwile przerywa i załacza tę stronkę.

Dodano 27.09.2008 10:01:32:
oto logi ale z wczoraja bo tak się muli że siedziałbym ze 2 godziny przy skanowaniu

Kod: Zaznacz wszystko: ComboFix 08-08-24.03 - Kemuel 2008-09-26 20:43:32.2 - NTFSx86 MINIMAL Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.628 [GMT 2:00] Running from: C:\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((( Files Created from 2008-08-26 to 2008-09-26 ))))))))))))))))))))))))))))))) . 2008-09-26 16:09 . 2008-09-26 18:28 950,423 ---hs---- C:\WINDOWS\system32\sljtkdpa.ini 2008-09-26 16:09 . 2008-09-26 16:09 80,000 --a------ C:\WINDOWS\system32\apdktjls.dll 2008-09-26 16:06 . 2008-09-26 16:06 326,656 --a------ C:\WINDOWS\system32\tuvTlmJA.dll 2008-09-26 16:06 . 2008-09-26 20:46 2,085 --ahs---- C:\WINDOWS\system32\AJmlTvut.ini2 2008-09-26 16:06 . 2008-09-26 20:49 0 --ahs---- C:\WINDOWS\system32\AJmlTvut.ini 2008-09-26 16:01 . 2008-09-26 16:01 38,272 --a------ C:\WINDOWS\system32\nnnlkkki.dll 2008-09-26 16:01 . 2008-09-26 16:01 38,272 --a------ C:\WINDOWS\system32\ljJYPhIY.dll 2008-09-26 16:00 . 2008-09-26 11:29 409,600 --a------ C:\WINDOWS\rwlfsdmk.dll 2008-09-26 16:00 . 2008-09-26 11:29 331,776 --a------ C:\WINDOWS\dfmlxbpkbkl.dll 2008-09-26 16:00 . 2008-09-26 11:29 208,896 --a------ C:\WINDOWS\peltodgx.dll 2008-09-26 16:00 . 2008-09-26 11:29 204,800 --a------ C:\WINDOWS\onfwbsak.dll 2008-09-26 16:00 . 2008-09-26 11:29 151,552 --a------ C:\WINDOWS\exwf.exe 2008-09-26 16:00 . 2008-09-26 11:29 147,456 --a------ C:\WINDOWS\fbxrqtwn.exe 2008-09-26 16:00 . 2008-09-26 16:00 38,272 --a------ C:\WINDOWS\system32\urqQkhHA.dll 2008-09-26 16:00 . 2008-09-26 16:00 38,272 --a------ C:\WINDOWS\system32\ssqPiigf.dll 2008-09-26 16:00 . 2008-09-26 16:00 38,272 --a------ C:\WINDOWS\system32\cbXPjIby.dll 2008-09-24 17:33 . 2008-09-24 17:33 <DIR> d-------- C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\InstallShield 2008-09-21 20:32 . 2008-09-24 17:36 <DIR> d-------- C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\GetRightToGo 2008-09-19 17:04 . 2008-09-19 17:04 <DIR> d-------- C:\WINDOWS\Easy CD-DA Extractor 11.5.3 2008-09-19 16:47 . 2008-09-19 16:47 <DIR> d-------- C:\WINDOWS\Easy CD-DA Extractor 11.1 2008-09-19 16:47 . 2008-09-19 17:12 <DIR> d-a------ C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\TEMP 2008-09-19 16:31 . 2008-09-19 16:31 28,672 --a------ C:\file.datastore 2008-09-18 15:30 . 2008-09-18 16:03 <DIR> d-------- C:\Program Files\CDex_150 2008-09-17 19:27 . 2008-09-17 19:27 <DIR> d-------- C:\Program Files\Photo Viewer 2008-09-17 13:13 . 2008-09-17 13:17 <DIR> d-------- C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\Nowe Gadu-Gadu 2008-09-15 19:05 . 2008-09-15 19:05 <DIR> d-------- C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\RST 2008-08-26 19:22 . 2008-09-23 12:45 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-08-26 19:14 . 2008-08-30 12:13 97,928 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-08-26 19:14 . 2008-08-30 12:13 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-08-26 19:13 . 2008-09-26 13:35 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-08-26 19:13 . 2008-08-26 19:13 <DIR> d-------- C:\Program Files\AVG 2008-08-26 19:13 . 2008-08-27 12:14 <DIR> d-------- C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\AVGTOOLBAR 2008-08-26 19:13 . 2008-08-26 19:14 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\avg8 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-26 18:38 --------- d-----w C:\Program Files\PeerGuardian2 2008-09-23 16:58 --------- d-----w C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\Azureus 2008-09-18 13:37 --------- d-----w C:\Program Files\CDex150beta7 2008-09-18 11:58 --------- d-----w C:\Program Files\Gadu-Gadu 2008-09-17 16:00 --------- d-----w C:\Program Files\Odkurzacz 2008-09-15 17:05 --------- d-----w C:\Program Files\Trans 2008-09-12 14:36 --------- d-----w C:\Program Files\Winamp 2008-09-06 05:23 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-09-06 05:23 --------- d-----w C:\Program Files\Azureus 2008-09-06 05:23 --------- d-----w C:\Program Files\AVIcodec 2008-09-06 05:23 --------- d-----w C:\Documents and Settings\Kemuel\Dane aplikacji\uTorrent 2008-09-06 05:23 --------- d-----w C:\Documents and Settings\Kemuel\Dane aplikacji\Azureus 2008-09-02 14:12 --------- d-----w C:\Program Files\Common Files\Adobe 2008-08-26 16:25 --------- d-----w C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\Lavasoft 2008-08-25 17:49 --------- d-sh--w C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Dane aplikacji\sysproc64 2008-08-25 17:49 --------- d-sh--w C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Dane aplikacji\sysproc64 2008-08-25 17:49 --------- d-sh--w C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Dane aplikacji\sysproc64 2008-08-25 17:19 2,830,141 ----a-r C:\ComboFix.exe 2008-08-25 17:10 --------- d-sh--w C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT\Dane aplikacji\sysproc64 2008-08-24 17:54 --------- d-----w C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\Ulead Systems 2008-08-24 17:53 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Ulead Systems 2008-08-17 17:01 --------- d-----w C:\Program Files\Common Files\Thraex Software 2008-08-17 16:22 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-17 16:22 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-08-17 09:56 --------- d-----w C:\Program Files\ScanDrv 2008-08-08 07:32 --------- d-----w C:\Program Files\DeskSpace 2008-08-08 07:27 --------- d-----w C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\OtakuSoftware 2008-08-03 10:03 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-07-30 18:01 --------- d-----w C:\Program Files\Ganymede 2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe . ((((((((((((((((((((((((((((( snapshot@2008-08-25_19.43.25.81 ))))))))))))))))))))))))))))))))))))))))) . + 2008-09-24 15:35:58 68,608 ----a-w C:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll + 2008-09-24 15:36:12 72,192 ----a-w C:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll + 2008-09-24 15:36:13 4,308,992 ----a-w C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll + 2008-09-24 15:36:14 482,304 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll + 2008-09-24 15:36:08 2,878,976 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll + 2008-09-24 15:35:51 258,048 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll + 2008-09-24 15:35:51 114,176 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll + 2008-09-24 15:36:22 260,096 ----a-w C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll + 2008-09-24 15:36:03 5,025,792 ----a-w C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll + 2008-09-24 15:35:57 10,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll + 2008-09-24 15:35:50 503,808 ----a-w C:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll + 2008-09-24 15:35:53 13,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll + 2008-09-24 15:36:11 8,192 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll + 2008-09-24 15:36:11 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll + 2008-09-24 15:36:12 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll + 2008-09-24 15:35:55 413,696 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll + 2008-09-24 15:35:55 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll + 2008-09-24 15:35:56 647,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll + 2008-09-24 15:35:56 73,728 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll + 2008-09-24 15:35:53 745,472 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll + 2008-09-24 15:36:24 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll + 2008-09-24 15:36:24 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll + 2008-09-24 15:35:47 28,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll + 2008-09-24 15:36:23 667,648 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll + 2008-09-24 15:36:25 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll + 2008-09-24 15:35:49 12,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll + 2008-09-24 15:35:49 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll + 2008-09-24 15:35:49 7,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll + 2008-09-24 15:36:18 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll + 2008-09-24 15:35:59 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll + 2008-09-24 15:36:19 389,120 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll + 2008-09-24 15:36:15 716,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll + 2008-09-24 15:35:52 884,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll + 2008-09-24 15:36:09 5,050,368 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll + 2008-09-24 15:36:00 188,416 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll + 2008-09-24 15:35:59 397,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll + 2008-09-24 15:36:01 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll + 2008-09-24 15:36:20 700,416 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll + 2008-09-24 15:36:16 368,640 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll + 2008-09-24 15:36:21 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll + 2008-09-24 15:36:17 299,008 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll + 2008-09-24 15:36:17 131,072 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll + 2008-09-24 15:35:57 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll + 2008-09-24 15:36:02 114,688 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll + 2008-09-24 15:36:22 835,584 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll + 2008-09-24 15:36:04 86,016 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll + 2008-09-24 15:36:05 823,296 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll + 2008-09-24 15:36:06 5,316,608 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll + 2008-09-24 15:36:07 2,035,712 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll + 2008-09-24 15:36:19 3,018,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll + 2008-09-24 16:01:16 26,624 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\7bd9c195b70879498504eb7fe0937f2d\Accessibility.ni.dll + 2008-09-24 16:01:17 860,160 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\c480212f487d464696234b8fd7762938\AspNetMMCExt.ni.dll + 2008-09-24 16:01:18 237,568 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\f6c229c709cac54d8000c5314aa1487f\CustomMarshalers.ni.dll + 2008-09-24 16:01:17 15,360 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\dfsvc\b6cfaac394a20941a3bc521d109cf01c\dfsvc.ni.exe + 2008-09-24 16:01:20 880,640 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\53decedda568c64c8b6dfe320ab53aed\Microsoft.Build.Engine.ni.dll + 2008-09-24 16:01:20 81,920 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\13c6ed7567cf3145b9c50706f432ad73\Microsoft.Build.Framework.ni.dll + 2008-09-24 16:01:24 1,691,648 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\a12f5474e2d6644597d62c7d63ee2c1f\Microsoft.Build.Tasks.ni.dll + 2008-09-24 16:01:25 163,840 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\3b40911aafd9334087e9870fc0391569\Microsoft.Build.Utilities.ni.dll + 2008-09-24 16:01:28 1,724,416 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\6977e4a464ffef4ebdff9ea579ab38dd\Microsoft.VisualBasic.ni.dll + 2008-09-24 15:37:05 11,415,552 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\a00141ac992e8a448c263a2b78a18ccb\mscorlib.ni.dll + 2008-09-24 16:01:30 962,560 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\9f0dfcf5cb65474fb5ca9dafe93f1ddd\System.Configuration.ni.dll + 2008-09-24 15:39:51 6,688,768 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\e01cd043e4367d48a57f50a70832c5f6\System.Data.ni.dll + 2008-09-24 16:01:32 1,712,128 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Deployment\a9e3b5135c0af24d81a71101cef4b6d7\System.Deployment.ni.dll + 2008-09-24 15:40:46 10,723,328 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Design\65b1679ca220594aa11380022c03dc4d\System.Design.ni.dll + 2008-09-24 16:01:36 512,000 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\2f917cc51f9fc142819ce41b6dc2118c\System.DirectoryServices.Protocols.ni.dll + 2008-09-24 16:01:35 1,220,608 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\dccbaa0ed8e26c46b22af70365956100\System.DirectoryServices.ni.dll + 2008-09-24 15:37:45 229,376 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\3bc0f59773c7304c8390aa37c753d99c\System.Drawing.Design.ni.dll + 2008-09-24 15:37:50 1,626,112 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\5418fe9bc44e824ab3d292c1e7834efe\System.Drawing.ni.dll + 2008-09-24 16:01:38 659,456 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\e9c972f2957e6f4fbb946962eda14fa4\System.EnterpriseServices.ni.dll + 2008-09-24 16:01:38 294,912 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\e9c972f2957e6f4fbb946962eda14fa4\System.EnterpriseServices.Wrapper.dll + 2008-09-24 16:01:40 729,088 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Security\7e682377c0b87545a94257c077ed0a09\System.Security.ni.dll + 2008-09-24 16:01:42 684,032 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\65977177bdf0b94a8f953f913f8522fc\System.Transactions.ni.dll + 2008-09-24 16:02:15 2,310,144 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\de130b911d7bf1479479058cfa542c7f\System.Web.Mobile.ni.dll + 2008-09-24 16:02:15 237,568 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\488b6918260892409224ff7c8e1aca5f\System.Web.RegularExpressions.ni.dll + 2008-09-24 16:02:19 1,945,600 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\f855ce7c648553489882a75747658911\System.Web.Services.ni.dll + 2008-09-24 16:02:07 11,808,768 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\702ca32f09c83b4db086397e3222e89a\System.Web.ni.dll + 2008-09-24 15:38:25 13,107,200 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ca3477f424de6e4090259fcb0056b499\System.Windows.Forms.ni.dll + 2008-09-24 15:39:04 5,640,192 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\f27bcb1bf241094b81d09382b9e8f661\System.Xml.ni.dll + 2008-09-24 15:37:41 8,093,696 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\a26dc71ae123d745b8786ccb777bfb7f\System.ni.dll + 2008-09-19 14:47:09 473,600 ----a-w C:\WINDOWS\Easy CD-DA Extractor 11.1\uninstall.exe + 2008-09-19 15:04:44 473,600 ----a-w C:\WINDOWS\Easy CD-DA Extractor 11.5.3\uninstall.exe - 2008-08-25 17:20:15 4,009,984 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-09-26 18:13:30 4,124,672 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT - 2008-08-25 17:20:15 151,552 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-09-26 18:13:30 151,552 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat - 2003-02-20 18:09:46 57,344 -c--a-w C:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe + 2005-09-23 05:28:52 72,704 ----a-w C:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe - 2003-02-20 18:09:32 5,120 -c--a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp10.dll + 2005-09-23 05:28:52 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp10.dll + 2005-09-23 05:28:56 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp20_mscorwks.dll + 2005-09-23 05:28:58 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\sbscmp20_perfcounter.dll + 2005-09-23 05:28:56 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\SharedReg12.dll - 2003-02-20 17:43:50 131,072 -c--a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll + 2005-09-23 05:28:52 86,528 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll + 2005-09-23 05:28:36 18,944 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll + 2005-09-23 05:28:42 136,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll + 2005-09-23 05:28:44 4,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll + 2005-09-23 05:29:04 183,808 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll + 2005-09-23 05:28:28 208,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll + 2005-09-23 05:28:56 10,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll + 2005-09-23 05:28:58 138,240 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll + 2005-09-23 05:28:36 87,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\alink.dll + 2005-09-23 05:28:58 55,488 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe + 2005-09-23 05:28:32 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe + 2005-09-23 05:28:32 10,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll + 2005-09-23 05:28:32 8,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll + 2005-09-23 05:28:32 23,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll + 2005-09-23 05:28:32 70,656 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll + 2005-09-23 05:28:32 13,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe + 2005-09-23 05:28:32 26,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe + 2005-09-23 05:28:32 106,496 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe + 2005-09-23 05:28:32 29,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe + 2005-09-23 05:28:32 29,888 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe + 2005-09-23 05:28:32 503,808 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll + 2005-09-23 05:28:56 106,496 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CasPol.exe + 2005-09-23 05:28:56 88,576 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll + 2005-09-23 05:28:42 76,984 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe + 2005-09-23 05:28:42 1,144,832 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscomp.dll + 2005-09-23 05:28:42 13,312 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll + 2005-09-23 05:28:58 17,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll + 2005-09-23 05:28:56 68,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll + 2005-09-23 05:28:44 31,936 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cvtres.exe + 2005-09-23 05:28:38 52,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfdll.dll + 2005-09-23 05:28:38 4,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe + 2005-09-23 05:29:12 547,840 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll + 2005-09-23 05:28:56 788,992 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll + 2005-09-23 05:28:50 9,216 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fusion.dll + 2005-09-23 05:28:56 9,728 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe + 2005-09-23 05:28:56 8,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll + 2005-09-23 05:28:56 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEHost.dll + 2005-09-23 05:28:56 5,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll + 2005-09-23 05:28:56 224,952 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe + 2005-09-23 05:28:56 28,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe + 2005-09-23 05:28:56 55,296 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll + 2005-09-23 05:28:56 72,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll + 2005-09-23 05:28:48 40,960 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe + 2005-09-23 05:01:16 609,472 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe + 2005-09-23 04:29:48 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1025.dll + 2005-09-23 04:32:24 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1028.dll + 2005-09-23 04:34:10 82,944 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1029.dll + 2005-09-23 04:34:12 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1030.dll + 2005-09-23 04:34:44 85,504 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1031.dll + 2005-09-23 04:36:24 87,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1032.dll + 2005-09-23 01:46:14 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1033.dll + 2005-09-23 04:38:26 81,408 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1035.dll + 2005-09-23 04:38:52 86,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1036.dll + 2005-09-23 04:40:30 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1037.dll + 2005-09-23 04:40:32 83,968 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1038.dll + 2005-09-23 04:40:56 84,480 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1040.dll + 2005-09-23 04:42:58 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1041.dll + 2005-09-23 04:44:58 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1042.dll + 2005-09-23 04:46:38 83,456 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1043.dll + 2005-09-23 04:46:38 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1044.dll + 2005-09-23 04:46:40 83,456 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1045.dll + 2005-09-23 04:47:04 82,432 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1046.dll + 2005-09-23 04:47:30 82,432 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1049.dll + 2005-09-23 04:47:32 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1053.dll + 2005-09-23 04:47:32 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1055.dll + 2005-09-23 04:30:18 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.2052.dll + 2005-09-23 04:47:06 84,480 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.2070.dll + 2005-09-23 04:29:50 80,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.3076.dll + 2005-09-23 04:36:48 85,504 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.3082.dll + 2005-09-23 05:57:06 245,408 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\unicows.dll + 2005-09-23 05:28:48 413,696 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll + 2005-09-23 05:28:48 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll + 2005-09-23 05:28:48 647,168 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll + 2005-09-23 05:28:48 73,728 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll + 2005-09-23 05:28:48 745,472 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll + 2005-09-23 05:29:10 110,592 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll + 2005-09-23 05:29:10 372,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll + 2005-09-23 05:29:08 667,648 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll + 2005-09-23 05:28:30 28,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll + 2005-09-23 05:29:10 5,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll + 2005-09-23 05:28:30 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll + 2005-09-23 05:28:30 12,800 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll + 2005-09-23 05:28:30 7,168 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll + 2005-09-23 05:28:32 87,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll + 2005-09-23 05:28:48 69,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe + 2005-09-23 05:28:56 800,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll + 2005-09-23 05:28:56 73,216 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll + 2005-09-23 05:28:56 288,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll + 2005-09-23 05:28:56 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll + 2005-09-23 05:28:56 326,144 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll + 2005-09-23 05:28:56 81,408 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorld.dll + 2005-09-23 05:28:56 4,308,992 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll + 2005-09-23 05:28:56 102,400 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll + 2005-09-23 05:29:00 330,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll + 2005-09-23 05:28:56 67,072 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll + 2005-09-23 05:28:50 9,216 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll + 2005-09-23 05:28:56 226,816 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll + 2005-09-23 05:28:56 66,240 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe + 2005-09-23 05:28:56 10,240 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscortim.dll + 2005-09-23 05:28:50 5,615,616 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll + 2005-09-23 05:29:00 22,528 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MUI\[u]0[/u]409\mscorsecr.dll + 2005-09-23 05:28:56 96,440 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe + 2005-09-23 05:28:56 14,848 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normalization.dll + 2005-09-23 05:28:56 78,336 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll + 2005-09-23 05:28:50 136,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\peverify.dll + 2005-09-23 05:28:56 53,248 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe + 2005-09-23 05:28:56 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe + 2005-09-23 05:29:02 59,072 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe + 2005-09-23 05:28:58 7,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll + 2005-09-23 05:28:56 107,520 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\shfusion.dll + 2005-09-23 05:29:00 85,504 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll + 2005-09-23 05:28:56 377,344 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\SOS.dll + 2005-09-23 05:28:56 110,592 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll + 2005-09-23 05:28:58 389,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll + 2005-09-23 05:28:56 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll + 2005-09-23 05:28:56 2,878,976 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.dll + 2005-09-23 05:28:56 482,304 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll + 2005-09-23 05:28:56 716,800 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll + 2005-09-23 05:28:38 884,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll + 2005-09-23 05:28:56 5,050,368 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Design.dll + 2005-09-23 05:28:56 397,312 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll + 2005-09-23 05:28:56 188,416 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll + 2005-09-23 05:28:56 3,018,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.dll + 2005-09-23 05:28:56 81,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll + 2005-09-23 05:28:56 700,416 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll + 2005-09-23 05:28:56 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll + 2005-09-23 05:28:56 47,616 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll + 2005-09-23 05:28:56 114,176 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll + 2005-09-23 05:28:56 368,640 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Management.dll + 2005-09-23 05:28:56 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll + 2005-09-23 05:28:56 299,008 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll + 2005-09-23 05:28:56 131,072 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll + 2005-09-23 05:28:56 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Security.dll + 2005-09-23 05:28:56 114,688 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll + 2005-09-23 05:28:56 260,096 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll + 2005-09-23 05:28:56 5,025,792 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.dll + 2005-09-23 05:28:56 835,584 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll + 2005-09-23 05:28:56 86,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll + 2005-09-23 05:28:56 823,296 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll + 2005-09-23 05:28:56 5,316,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll + 2005-09-23 05:28:56 2,035,712 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.XML.dll + 2005-09-23 05:28:56 71,680 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL + 2005-09-23 05:29:06 1,140,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe + 2005-09-23 05:28:30 1,306,624 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll + 2005-09-23 05:28:32 298,496 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\webengine.dll + 2005-09-23 05:28:56 28,160 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll - 2008-08-25 17:36:44 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-08-26 16:42:05 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-08-26 16:00:03 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Internet Explorer\MSIMGSIZ.DAT - 2008-08-25 17:36:44 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2008-08-26 16:42:05 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2008-08-26 16:00:03 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008082620080827\index.dat - 2008-08-25 17:36:44 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat + 2008-08-26 16:42:05 65,536 -c--a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat + 2005-09-23 05:28:38 83,456 ----a-w C:\WINDOWS\system32\dfshim.dll - 2008-05-04 18:47:21 19,392 ----a-w C:\WINDOWS\system32\drivers\avgmfx86.sys + 2008-08-30 10:13:55 26,824 ----a-w C:\WINDOWS\system32\drivers\avgmfx86.sys - 2003-02-20 18:06:24 155,648 ----a-w C:\WINDOWS\system32\mscoree.dll + 2005-09-23 05:28:52 270,848 ----a-w C:\WINDOWS\system32\mscoree.dll - 2003-02-20 17:43:38 16,896 -c--a-w C:\WINDOWS\system32\mscorier.dll + 2005-09-23 05:28:52 150,016 ----a-w C:\WINDOWS\system32\mscorier.dll - 2003-02-20 18:09:14 106,496 -c--a-w C:\WINDOWS\system32\mscories.dll + 2005-09-23 05:28:52 74,240 ----a-w C:\WINDOWS\system32\mscories.dll + 2005-09-23 05:29:00 6,144 ----a-w C:\WINDOWS\system32\mui\[u]0[/u]409\mscorees.dll - 2008-08-04 17:06:31 53,608 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-09-24 15:40:50 63,188 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-08-04 17:06:31 68,334 ----a-w C:\WINDOWS\system32\perfc015.dat + 2008-09-24 15:40:50 80,444 ----a-w C:\WINDOWS\system32\perfc015.dat - 2008-08-04 17:06:31 383,254 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-09-24 15:40:50 403,968 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-08-04 17:06:31 439,194 ----a-w C:\WINDOWS\system32\perfh015.dat + 2008-09-24 15:40:50 460,894 ----a-w C:\WINDOWS\system32\perfh015.dat - 2008-08-25 17:27:32 38,009 ----a-w C:\WINDOWS\system32\sysproc64\sysproc86.sys + 2008-08-26 16:42:26 38,009 ----a-w C:\WINDOWS\system32\sysproc64\sysproc86.sys + 2006-12-01 20:56:00 96,256 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll + 2005-09-23 05:29:16 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll + 2005-09-23 05:29:16 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll + 2005-09-23 05:29:16 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll + 2006-12-01 20:54:32 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll + 2006-12-01 20:54:34 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll + 2006-12-01 20:54:32 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll + 2006-12-01 22:25:52 1,101,824 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll + 2006-12-01 22:25:56 1,093,120 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll + 2006-12-01 22:25:58 69,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll + 2006-12-01 22:26:00 57,856 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll + 2006-12-01 22:08:00 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll + 2006-12-01 22:08:00 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll + 2006-12-01 22:08:00 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll + 2006-12-01 22:08:00 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll + 2006-12-01 22:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll + 2006-12-01 22:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll + 2006-12-01 22:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll + 2006-12-01 22:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll + 2006-12-01 22:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll + 2006-12-01 22:46:44 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll + 2008-09-24 15:35:51 258,048 ----a-w C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll + 2008-09-24 15:35:51 114,176 ----a-w C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{129D532E-E2EC-4527-B4BA-4626830EFE18}] 2008-09-26 11:29 331776 --a------ C:\WINDOWS\dfmlxbpkbkl.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{93925418-6F10-4ED3-BD05-EA4E38EF1734}] 2008-09-26 16:06 326656 --a------ C:\WINDOWS\system32\tuvTlmJA.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{BAB8F6DC-41B1-440F-A066-AAC224906880}"= "C:\WINDOWS\peltodgx.dll" [2008-09-26 11:29 208896] [HKEY_CLASSES_ROOT\clsid\{bab8f6dc-41b1-440f-a066-aac224906880}] [HKEY_CLASSES_ROOT\peltodgx.1] [HKEY_CLASSES_ROOT\TypeLib\{37FA5B93-7872-46CC-A9CB-CC257DAFF166}] [HKEY_CLASSES_ROOT\peltodgx] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:44 1667584] "PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2005-04-23 20:03 1175552] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-06-02 16:03 1957888] "H/PC Connection Agent"="C:\PROGRA~1\MICROS~3\wcescomm.exe" [2005-11-15 19:44 1200128] "Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2008-03-03 14:44 266240] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112] "Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-10-04 01:00 28672] "CTStartup"="C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" [2001-12-20 01:00 28672] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-04-26 08:29 237568] "RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 17:35 32768] "InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2005-07-08 16:25 1397760] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-30 12:14 1235736] "b4233ad1"="C:\WINDOWS\system32\apdktjls.dll" [2008-09-26 16:09 80000] "WINDVDPatch"="CTHELPER.EXE" [2002-02-07 20:01 40960 C:\WINDOWS\system32\CTHELPER.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360] C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-09-02 16:13:11 113664] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "onfwbsak"= {D75C898A-9C84-4612-AE82-8B8808ABE868} - C:\WINDOWS\onfwbsak.dll [2008-09-26 11:29 204800] "rwlfsdmk"= {1799D7BE-8B27-4591-A46F-C83155D78E56} - C:\WINDOWS\rwlfsdmk.dll [2008-09-26 11:29 409600] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\oembios.exe," [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\tuvTlmJA [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winns73.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-07-09 09:39 2119104 C:\Program Files\Gadu-Gadu\gg.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Azureus\\Azureus.exe"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service S1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-30 12:13] S2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-30 12:13] S2 ScanDrv;ScanDrv;C:\WINDOWS\system32\drivers\ScanDrv.sys [1999-03-19 11:17] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1f5011b0-362a-11dd-80b5-00e04cee6d96}] \Shell\AutoRun\command - EXPLORER.EXE \Shell\explore\Command - EXPLORER.EXE \Shell\open\Command - EXPLORER.EXE . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-TRUCK & CARGO Online - c:\tccargo\tccargo.exe . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s O8 -: E&ksport do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-26 20:48:14 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTStartup = C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run???h??????s?????\?w? ?w???????w???w4???????.??w4???????4???TA?s4???????L&7????wd??w????????\???\??????????????w-??w\???\?????????`??????C@?\???\??????s????\??????s\???0&7?A??s0&7??C@?x???`|?w\?????@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\WINDOWS\system32\tuvTlmJA.dll PROCESS: C:\WINDOWS\explorer.exe -> C:\WINDOWS\system32\tuvTlmJA.dll . Completion time: 2008-09-26 20:53:41 ComboFix-quarantined-files.txt 2008-09-26 18:53:35 Pre-Run: 1,131,433,984 bajtów wolnych Post-Run: 1,809,620,992 bajtów wolnych 478

Kod: Zaznacz wszystko: [b]SDFix: Version 1.219 [/b] Run by Kemuel on 2008-09-26 at 20:19 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Restoring Windows Product ID To Remove Fake Virus Alert Restoring Time Format To Remove Fake Virus Alert Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\system32\mlJAqqQI.dll - Deleted C:\DOCUME~1\KEMUEL~1.YYY\USTAWI~1\Temp\lwpwer.exe.bat - Deleted C:\DOCUME~1\KEMUEL~1.YYY\USTAWI~1\Temp\sfsrv.exe.bat - Deleted C:\DOCUME~1\KEMUEL~1.YYY\USTAWI~1\Temp\smchk.exe.bat - Deleted C:\DOCUME~1\KEMUEL~1.YYY\USTAWI~1\Temp\lwpwer.exe - Deleted C:\DOCUME~1\KEMUEL~1.YYY\USTAWI~1\Temp\removalfile.bat - Deleted C:\DOCUME~1\KEMUEL~1.YYY\USTAWI~1\Temp\sfsrv.exe - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-26 20:30:35 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:0000007e "TracesSuccessful"=dword:00000004 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{52A34D90-EAFB-0346-55E0-16E262C0945D}] "pakegeamfcfgcpojhcegkjoaiibindff"=hex:69,61,6f,63,68,6c,6d,68,68,6a,63,69,69,6f,64,6e,6d,64,00,00 "abedmcdbmpkdockjlockofhjknlociedml"=hex:69,61,6f,63,68,6c,6d,68,68,6a,63,69,69,6f,64,6e,6d,64,00,00 [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Twain] "y\1r?ó?d?B\1o? ?d?o?m?y?[\1l?n?e?"="C:\WINDOWS\Twain_32\SCANDRV\TWAIN_32.ds" scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus" "C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager" "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager" "C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application" "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager" "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager" "C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Wed 4 Aug 2004 60,928 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe" Fri 18 Jan 2008 196,732 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\gg_pion.exe" Fri 3 Oct 2003 524,288 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\skplayer.exe" Sat 24 Jun 2006 30,208 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\D2\3u6qnadfl.exe" Wed 31 May 2006 17,408 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\D2\4ik54sq.exe" Tue 14 Nov 2006 140,288 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\D2\d2maphack.dll" Tue 18 Jul 2006 54,784 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\D2\d2maphack.sys" Fri 19 Oct 2007 2,647,172 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\Ice Tower\icytower13_install.exe" Fri 27 Jul 2007 208,896 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\SpeedSim\SpeedKernel.dll" Fri 27 Jul 2007 401,408 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\SpeedSim\SpeedSim.exe" Sat 23 Feb 2008 1,859,715 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\C.S\C.S 1.5\4961-podbot25installer.zip" [b]Finished![/b]

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:56: VIRUS ALERT!, on 2008-09-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\niezbędnik\instalki\antywirusy i logi\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe, O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O3 - Toolbar: peltodgx - {BAB8F6DC-41B1-440F-A066-AAC224906880} - C:\WINDOWS\peltodgx.dll O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [b4233ad1] rundll32.exe "C:\WINDOWS\system32\apdktjls.dll",b O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~3\wcescomm.exe" O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O21 - SSODL: onfwbsak - {D75C898A-9C84-4612-AE82-8B8808ABE868} - C:\WINDOWS\onfwbsak.dll O21 - SSODL: rwlfsdmk - {1799D7BE-8B27-4591-A46F-C83155D78E56} - C:\WINDOWS\rwlfsdmk.dll O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

**Posty:** 8001 · przez **Okocza** 27 Wrz 2008, 11:11

otwórz notatnik i wklej:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\sljtkdpa.ini C:\WINDOWS\system32\apdktjls.dll C:\WINDOWS\system32\tuvTlmJA.dll C:\WINDOWS\system32\AJmlTvut.ini2 C:\WINDOWS\system32\AJmlTvut.ini C:\WINDOWS\system32\nnnlkkki.dll C:\WINDOWS\system32\ljJYPhIY.dll C:\WINDOWS\dfmlxbpkbkl.dll C:\WINDOWS\peltodgx.dll C:\WINDOWS\onfwbsak.dll C:\WINDOWS\exwf.exe C:\WINDOWS\fbxrqtwn.exe C:\WINDOWS\system32\urqQkhHA.dll C:\WINDOWS\system32\ssqPiigf.dll C:\WINDOWS\system32\cbXPjIby.dll Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{129D532E-E2EC-4527-B4BA-4626830EFE18}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{93925418-6F10-4ED3-BD05-EA4E38EF1734}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] [-HKEY_CLASSES_ROOT\clsid\{bab8f6dc-41b1-440f-a066-aac224906880}] [-HKEY_CLASSES_ROOT\peltodgx.1] [-HKEY_CLASSES_ROOT\TypeLib\{37FA5B93-7872-46CC-A9CB-CC257DAFF166}] [-HKEY_CLASSES_ROOT\peltodgx] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "b4233ad1"=- [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] [-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1f5011b0-362a-11dd-80b5-00e04cee6d96}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

Kod: Zaznacz wszystko: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 O4 - HKLM\..\Run: [b4233ad1] rundll32.exe "C:\WINDOWS\system32\apdktjls.dll",b

to na fix w hj

wracasz z nowymi logami z HJ i Combofix

**Posty:** 684 · przez **djarta** 27 Wrz 2008, 11:33

- REDUCED FUNCTIONALITY MODE -

Ograniczony ComboFix, ale zobaczymy czy się usuwanie ukończy pomyślnie - czekamy...

===============================
K.

**Posty:** 358 · przez **Kemuel** 02 Paź 2008, 18:44

witam po długiej przerwie
a dlatego że zrobiłem ten wklejony CFSscript i nałożyłem go na ikonę combofixa wtedy zaczoł pobierać jakieś uaktualnienia z internetu następnie po pobraniu zaczoł skanować i po skanie zaczoł procedurę ponownego uruchamiania i koniec nie mogę do teraz normalnie odpalić wyskakiwał mi w połowie ładowania systemu komunikat że nie może rozmoznać nazwy obiektu i po wciśnięciu OK zaczyna na nowo się ładować system jabym zrobił uruchom ponownie i znowu w połowie ładowania porzerywa i pojawia się okienko brak pliku "ISEAS.exe" czy coś w tym stylu i po wciśnięciu OK znowu się restartuje i tak w kółko aż wreszczie wpadłem na pomysł aby odpaliś w trybie awaryjnym ale to samo dopiero po wejściu przez uruchom w ostatniej znanej dobrej nastawach i wlazł do windy więc zaraz do was piszę tyle że jak wyjdę i będę próbował wejść normalnie to znowu pokazuje brak tego pliku.
co namieszł combofix napiszczie jak to naprawić bo jeszcze te wirusy mi zostały potem znowu poskanuje i dam logi.

**Posty:** 8 · przez **Reeze** 02 Paź 2008, 20:04

jaki(e) masz program(y) antywirusowe? jeżeli wymienisz antivirus xp to musze cię zmartwić... to jest program udający antywirusa, to on komunikaty 'Virus Alert' wyświetla zamiast zegara.

**Posty:** 18165 · przez **wojtas** 02 Paź 2008, 20:21

włóż płytkę windowsa - zbootuj ją. wejdź do konsoli odzyskiwania i w niej wpisz

chkdsk x: /r

gdzie x to litera partycji systemowej. i sprobuj dac logi

**Posty:** 358 · przez **Kemuel** 03 Paź 2008, 17:33

używam AVG Anti-Virus Free wersja 8.0.173 nic poza tym nie mam od czasu do czasu skanuję kompa dodatkowo hijackeim combofixem i sdfixem
jak znacie coś lepszego od avg oczywiście free do doradźcie
a logi zaraz wygeneruję nowe i wkleje

**Posty:** 8 · przez **Reeze** 03 Paź 2008, 20:33

Pobierz Avasta (darmowy) http://www.programosy.pl/program,avast-home.html, zeskanuj a jak znajdzie wirusy to je usuń, potem go odinstaluj, i wgraj Kaspersky Internet Security (trial) http://www.programosy.pl/program,kaspersky-internet.html i znów ponownie skanuj. I jak ci wygodnie, możesz mieć Avasta darmowego albo Kasperskyego na 30 dni. Ja tobie polecam to drugie, daje pełną ochronę komputera. Może i jest na 30 dni, to byś klucz znalazł (wiem, wiem... nielegalne) i miał go na te kilkaset dni.

**Posty:** 358 · przez **Kemuel** 03 Paź 2008, 21:17

poniżej zamieszczam świeżo wygenerowane logi ,oceńcie je i piszczie czy wszystko już gra
z góry dzięki

Kod: Zaznacz wszystko: ComboFix 08-09-26.01 - Kemuel 2008-10-03 20:44:55.4 - NTFSx86 MINIMAL Uruchomiony z: C:\ComboFix.exe [color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color] . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-03 do 2008-10-03 ))))))))))))))))))))))))))))))) . 2008-09-27 10:23 . 2008-09-27 10:23 <DIR> d-------- C:\Program Files\MicroAntivirus 2008-09-27 10:18 . 2008-09-27 10:37 952,793 ---hs---- C:\WINDOWS\system32\cdyxmwqk.ini 2008-09-24 17:33 . 2008-09-24 17:33 <DIR> d-------- C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\InstallShield 2008-09-21 20:32 . 2008-09-24 17:36 <DIR> d-------- C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\GetRightToGo 2008-09-19 17:04 . 2008-09-19 17:04 <DIR> d-------- C:\WINDOWS\Easy CD-DA Extractor 11.5.3 2008-09-19 16:47 . 2008-09-19 16:47 <DIR> d-------- C:\WINDOWS\Easy CD-DA Extractor 11.1 2008-09-19 16:47 . 2008-09-19 17:12 <DIR> d-a------ C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\TEMP 2008-09-19 16:31 . 2008-09-19 16:31 28,672 --a------ C:\file.datastore 2008-09-18 15:30 . 2008-09-18 16:03 <DIR> d-------- C:\Program Files\CDex_150 2008-09-17 19:27 . 2008-09-17 19:27 <DIR> d-------- C:\Program Files\Photo Viewer 2008-09-17 13:13 . 2008-09-17 13:17 <DIR> d-------- C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\Nowe Gadu-Gadu 2008-09-15 19:05 . 2008-09-15 19:05 <DIR> d-------- C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\RST . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-03 18:48 262,144 ---ha-w C:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT 2008-10-03 18:42 262,144 ---ha-w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT 2008-10-03 18:42 --------- d-----w C:\Program Files\PeerGuardian2 2008-10-03 15:51 --------- d-----w C:\Program Files\Odkurzacz 2008-10-02 21:08 --------- d-----w C:\Program Files\Java 2008-09-27 12:05 2,857,629 ----a-r C:\ComboFix.exe 2008-09-23 16:58 --------- d-----w C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\Azureus 2008-09-18 13:37 --------- d-----w C:\Program Files\CDex150beta7 2008-09-18 11:58 --------- d-----w C:\Program Files\Gadu-Gadu 2008-09-15 17:05 --------- d-----w C:\Program Files\Trans 2008-09-12 14:36 --------- d-----w C:\Program Files\Winamp 2008-09-06 05:23 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-09-06 05:23 --------- d-----w C:\Program Files\Azureus 2008-09-06 05:23 --------- d-----w C:\Program Files\AVIcodec 2008-09-06 05:23 --------- d-----w C:\Documents and Settings\Kemuel\Dane aplikacji\uTorrent 2008-09-06 05:23 --------- d-----w C:\Documents and Settings\Kemuel\Dane aplikacji\Azureus 2008-09-02 14:12 --------- d-----w C:\Program Files\Common Files\Adobe 2008-08-30 10:13 97,928 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys 2008-08-30 10:13 10,520 ----a-w C:\WINDOWS\system32\avgrsstx.dll 2008-08-27 10:14 --------- d-----w C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\AVGTOOLBAR 2008-08-26 17:14 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\avg8 2008-08-26 17:13 --------- d-----w C:\Program Files\AVG 2008-08-26 16:25 --------- d-----w C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\Lavasoft 2008-08-24 17:54 --------- d-----w C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\Ulead Systems 2008-08-24 17:53 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Ulead Systems 2008-08-17 17:01 --------- d-----w C:\Program Files\Common Files\Thraex Software 2008-08-17 16:22 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-17 16:22 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-08-17 09:56 --------- d-----w C:\Program Files\ScanDrv 2008-08-08 07:32 --------- d-----w C:\Program Files\DeskSpace 2008-08-08 07:27 --------- d-----w C:\Documents and Settings\Kemuel.YYY-LBVCD7WBFM1\Dane aplikacji\OtakuSoftware 2008-08-03 10:03 --------- d-----w C:\Program Files\Microsoft ActiveSync 2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584] "PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2005-04-23 1175552] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-06-02 1957888] "H/PC Connection Agent"="C:\PROGRA~1\MICROS~3\wcescomm.exe" [2005-11-15 1200128] "Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2008-03-03 266240] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 2119104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 90112] "Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-10-04 28672] "CTStartup"="C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" [2001-12-20 28672] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-04-26 237568] "RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 32768] "InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2005-07-08 1397760] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-10-02 1234712] "WINDVDPatch"="CTHELPER.EXE" [2002-02-07 C:\WINDOWS\system32\CTHELPER.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 15360] C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-09-02 113664] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winns73.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-07-09 09:39 2119104 C:\Program Files\Gadu-Gadu\gg.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Azureus\\Azureus.exe"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8461:TCP"= 8461:TCP:GoD High Port "8462:TCP"= 8462:TCP:GoD Low Port "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-30 97928] R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-30 231704] R2 ScanDrv;ScanDrv;C:\WINDOWS\system32\drivers\ScanDrv.sys [1999-03-19 152064] *Newly Created Service* - PGFILTER . . ------- Skan uzupełniający ------- . R0 -: HKCU-Main,Start Page = hxxp://www.wp.pl/ R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s O8 -: E&ksport do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-03 20:54:30 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTStartup = C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run???h??????s?????\?w? ?w???????w???w4???????.??w4???????4???TA?s4???????|:7????wd??w????????\???\??????????????w-??w\???\???????x?`??????C@?\???\??????s????\??????s\???`:7?A??s`:7??C@?x???`|?w\?????@ skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\PROGRA~1\MICROS~3\rapimgr.exe . ************************************************************************** . Czas ukończenia: 2008-10-03 21:01:05 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-10-03 19:00:49 Przed: 1˙691˙484˙160 bajt˘w wolnych Po: 1,620,275,200 bajt˘w wolnych 144

Kod: Zaznacz wszystko: [b]SDFix: Version 1.219 [/b] Run by Kemuel on 2008-10-03 at 17:40 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Restoring Windows Product ID To Remove Fake Virus Alert Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-03 17:48:37 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{52A34D90-EAFB-0346-55E0-16E262C0945D}] "pakegeamfcfgcpojhcegkjoaiibindff"=hex:69,61,6f,63,68,6c,6d,68,68,6a,63,69,69,6f,64,6e,6d,64,00,00 "abedmcdbmpkdockjlockofhjknlociedml"=hex:69,61,6f,63,68,6c,6d,68,68,6a,63,69,69,6f,64,6e,6d,64,00,00 [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Twain] "y\1r?ó?d?B\1o? ?d?o?m?y?[\1l?n?e?"="C:\WINDOWS\Twain_32\SCANDRV\TWAIN_32.ds" scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus" "C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager" "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager" "C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application" "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager" "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager" "C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Wed 4 Aug 2004 60,928 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe" Fri 18 Jan 2008 196,732 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\gg_pion.exe" Fri 3 Oct 2003 524,288 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\skplayer.exe" Sat 24 Jun 2006 30,208 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\D2\3u6qnadfl.exe" Wed 31 May 2006 17,408 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\D2\4ik54sq.exe" Tue 14 Nov 2006 140,288 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\D2\d2maphack.dll" Tue 18 Jul 2006 54,784 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\D2\d2maphack.sys" Fri 19 Oct 2007 2,647,172 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\Ice Tower\icytower13_install.exe" Fri 27 Jul 2007 208,896 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\SpeedSim\SpeedKernel.dll" Fri 27 Jul 2007 401,408 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\SpeedSim\SpeedSim.exe" Sat 23 Feb 2008 1,859,715 A..H. --- "C:\Documents and Settings\Kemuel\Pulpit\Jaggo7\C.S\C.S 1.5\4961-podbot25installer.zip" [b]Finished![/b]

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:04, on 2008-10-03 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Safe mode Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\niezbędnik\instalki\antywirusy i logi\HijackThis\HiJackThis2.0.2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~3\wcescomm.exe" O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe -- End of file - 4917 bytes

**Posty:** 684 · przez **djarta** 03 Paź 2008, 21:25

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\cdyxmwqk.ini Folder:: C:\Program Files\MicroAntivirus

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

===========================
K.