TA STRONA UŻYWA COOKIE. Dowiedz się więcej o celu ich używania i zmianie ustawień cookie w przeglądarce. Korzystając ze strony wyrażasz zgodę na używanie cookie, zgodnie z aktualnymi ustawieniami przeglądarki.
Od dnia 25.05.2018 r. na terenie Unii Europejskiej wchodzi w życie Rozporządzenie Parlamentu Europejskiego w sprawie ochrony danych osobowych. Prosimy o zapoznanie się z polityką prywatności oraz regulaminem serwisu  [X]

Prośba o sprawdzenie loga-amvo.exe - problemy z autorun....

Logi, zabezpieczenie komputera, danych. Programy antywirusowe antyspyware, firewall itp.
Regulamin forum
1. Każdy temat powinien odzwierciedlać treść wątku.
2. W przypadku wklejania logów; należy je wykonać od razu przynajmniej z dwóch narzędzi: FRST oraz z GMER
3. Wszelkie logi proszę publikować na przeznaczonych do tego stronach a w poście wklejać tylko link.
4. Nie wskazane jest skracanie logów, należy wkleić cały - od początku, do końca.
5. Nie wskazane jest podczepianie się do tematów innych użytkowników - proszę założyć nowy temat w dziale Bezpieczeństwo, ułatwi to pomoc sprawdzającemu.
6. Osoby nie posiadające odpowiedniej wiedzy, nie powinny sprawdzać logów, ponieważ grozi to poważnym uszkodzeniem systemu lub aplikacji zainstalowanych na komputerze.
7. Należy dokładnie opisać problem, występujące objawy oraz wszelkie podjęte działania.
8. Każdy skrypt jest unikatowy, napisany dla każdego przypadku z osobna, więc nie może być stosowany przez innych.
9. W przypadku zamieszczenia zrzutu ekranu (screenshot'a) proszę korzystać z zewnętrznego serwisu oferującego hosting zdjęć.

Prośba o sprawdzenie loga-amvo.exe - problemy z autorun....

Postprzez ZbiGG » 18 Lut 2008, 18:42

PostUA:


Witam, zamieszczam log z Combofix`a proszę o sprawdzenie i napisanie treści CFScript.txt

log


ComboFix 08-02-18.1 - ZbiGG 2008-02-18 17:30:16.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.571 [GMT 1:00]
Running from: C:\Documents and Settings\ZbiGG\Pulpit\ComboFix.exe
* Created a new restore point

[b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat
C:\Program Files\internet explorer\iekey.dll
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
C:\WINDOWS\system32\drivers\asc3550p.sys
D:\Autorun.inf

----- BITS: Possible infected sites -----

hxxp://au.download.windowsupdate
.
((((((((((((((((((((((((( Files Created from 2008-01-18 to 2008-02-18 )))))))))))))))))))))))))))))))
.

2008-02-18 12:39 . 2008-02-12 14:10 104,140 -r-hs---- C:\0hct8ybw.bat
2008-02-14 23:29 . 2008-02-14 23:29 <DIR> d-------- C:\Program Files\GameShadow
2008-02-14 23:11 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
2008-02-14 23:11 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2008-02-14 23:11 . 2008-01-08 21:00 799,424 -ra------ C:\WINDOWS\system32\tmp1BB.tmp
2008-02-14 23:11 . 2008-01-08 21:00 799,424 -ra------ C:\WINDOWS\system32\tmp1BA.tmp
2008-02-14 23:11 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2008-02-14 23:11 . 2007-07-20 00:57 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll
2008-02-14 23:09 . 2008-01-08 21:00 799,424 -ra------ C:\WINDOWS\system32\tmp19F.tmp
2008-02-14 23:09 . 2008-01-08 21:00 799,424 -ra------ C:\WINDOWS\system32\tmp19E.tmp
2008-02-14 22:56 . 2008-02-14 22:56 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-14 22:56 . 2008-02-14 22:56 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-14 13:17 . 2008-02-14 13:17 <DIR> d-------- C:\Program Files\OpenAL
2008-02-14 13:17 . 2008-01-08 21:00 799,424 -ra------ C:\WINDOWS\system32\tmp401.tmp
2008-02-14 13:17 . 2008-01-08 21:00 799,424 -ra------ C:\WINDOWS\system32\tmp400.tmp
2008-02-14 13:17 . 2008-02-14 23:11 418,480 --a------ C:\WINDOWS\system32\wrap_oal.dll
2008-02-14 13:17 . 2008-02-14 23:11 115,432 --a------ C:\WINDOWS\system32\OpenAL32.dll
2008-02-10 15:16 . 2008-02-10 15:16 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-02-10 15:16 . 2008-02-10 15:16 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-02-08 00:58 . 2008-02-08 00:58 57 --a------ C:\WINDOWS\wininit.ini
2008-02-07 12:42 . 2008-02-07 12:42 1,905 --a------ C:\WINDOWS\diagwrn.xml
2008-02-07 12:42 . 2008-02-07 12:42 1,905 --a------ C:\WINDOWS\diagerr.xml
2008-02-04 12:11 . 2008-02-04 12:11 <DIR> d-------- C:\Documents and Settings\ZbiGG\Dane aplikacji\DP_Technology
2008-02-04 11:31 . 2008-02-04 11:31 <DIR> d-------- C:\Documents and Settings\ZbiGG\Dane aplikacji\DP Technology
2008-02-04 11:28 . 2007-02-04 23:00 218 --a------ C:\WINDOWS\system32\5fc8.sentinel
2008-02-01 19:49 . 2008-02-01 19:49 24 --a------ C:\WINDOWS\system32\sysdate.ini
2008-02-01 13:23 . 2008-02-01 13:23 0 --a------ C:\WINDOWS\license.INI
2008-02-01 13:10 . 2008-02-08 01:07 <DIR> d-------- C:\Program Files\D.P.Technology
2008-02-01 13:07 . 2008-02-01 13:07 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-02-01 13:07 . 2008-02-01 13:07 <DIR> d-------- C:\Program Files\Common Files\SafeNet Sentinel
2008-01-29 14:40 . 2008-01-29 14:40 <DIR> d-------- C:\Program Files\JLC's Software
2008-01-29 14:40 . 2008-01-29 14:40 <DIR> d-------- C:\Documents and Settings\ZbiGG\Dane aplikacji\JLC's Software
2008-01-28 21:03 . 2008-01-28 21:03 <DIR> d-------- C:\Program Files\Alcohol Soft
2008-01-24 15:21 . 2008-01-24 15:21 8 --a------ C:\WINDOWS\Wincfg22c.drt

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-18 16:32 89,926,176 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-02-18 16:32 1,069,088 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-02-18 15:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-02-18 12:16 108,152 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-02-18 12:16 1,212,404 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-02-16 08:15 --------- d-----w C:\Documents and Settings\ZbiGG\Dane aplikacji\uTorrent
2008-02-15 23:34 --------- d-----w C:\Program Files\DC++
2008-02-14 22:31 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-02-10 14:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-08 00:12 --------- d-----w C:\Program Files\Valve
2008-02-03 19:39 --------- d-----w C:\Program Files\Winamp
2008-02-02 23:22 --------- d-----w C:\Documents and Settings\ZbiGG\Dane aplikacji\Skype
2008-02-02 11:22 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-02-01 13:49 --------- d-----w C:\Program Files\eMule
2008-01-31 16:53 91,700 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-01-21 09:42 --------- d-----w C:\Program Files\Gadu-Gadu
2008-01-16 21:59 --------- d-----w C:\Documents and Settings\ZbiGG\Dane aplikacji\MechSoft
2008-01-08 16:06 --------- d-----w C:\Program Files\LightScribeTemplateLabeler
2008-01-08 16:04 --------- d-----w C:\Documents and Settings\ZbiGG\Dane aplikacji\???????sAppData
2008-01-08 15:51 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\LightScribe
2008-01-08 15:50 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-01-06 21:55 --------- d-----w C:\Program Files\Windows Defender
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2007-12-07 02:14 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:42 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-11-23 00:09 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-11-19 13:54 111,104 ----a-w C:\WINDOWS\system32\uha.exe
2007-11-18 18:15 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
.
Kod: Zaznacz wszystko
<pre>
----a-w           325,204 2006-12-21 19:56:28  C:\swsetup\SP34746\WCAMC\FW_210_Silence Install .exe
</pre>



((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 21:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2007-01-29 22:02 200768]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-08-23 23:15 8478720]
"nwiz"="nwiz.exe" [2007-08-23 23:15 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-08-23 23:15 81920]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 13:36 827392]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-11-06 09:58 159744]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 19:29 39264]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Przyspieszenie uruchomienia programu AutoCAD.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Przyspieszenie uruchomienia programu AutoCAD.lnk
backup=C:\WINDOWS\pss\Przyspieszenie uruchomienia programu AutoCAD.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Service Manager.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Service Manager.lnk
backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva]
C:\WINDOWS\system32\amvo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\au]
C:\Program Files\Dealio\DealioAU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-06-27 18:03 152872 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--a------ 2006-07-26 21:44 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-12-05 12:30 2295072 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Media Codec Update Service]
--a------ 2007-04-08 17:44 303104 C:\Program Files\Essentials Codec Pack\update.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
--a------ 2007-10-23 01:47 360448 C:\Program Files\Winamp Remote\bin\OrbTray.exe

R3 R5U870FLx86;R5U870 UVC Lower Filter ;C:\WINDOWS\system32\Drivers\R5U870FLx86.sys [2006-10-18 00:09]
R3 R5U870FUx86;R5U870 UVC Upper Filter ;C:\WINDOWS\system32\Drivers\R5U870FUx86.sys [2006-10-18 00:09]
S2 SentinelFilter;SentinelFilter;F:\MAGNiTUDE\SENTINELFILTER.SYS []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{08edb7af-68f6-11dc-8d7a-001636fd3c1d}]
\Shell\AutoRun\command - G:\m.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{18d2d33c-aa68-11dc-886b-001636fd3c1d}]
\Shell\AutoRun\command - G:\h.cmd
\Shell\explore\Command - G:\h.cmd
\Shell\open\Command - G:\h.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{292a62f9-70c5-11dc-bfb5-001636fd3c1d}]
\Shell\AutoRun\command - H:\USBNB.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a86b377-62a0-11dc-8d6c-001636fd3c1d}]
\Shell\AutoRun\command - G:\3wcxx91.cmd
\Shell\explore\Command - G:\3wcxx91.cmd
\Shell\open\Command - G:\3wcxx91.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{48684d6f-5cb3-11dc-8d4d-001636fd3c1d}]
\Shell\AutoRun\command - I:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6688b9fa-d1a3-11dc-be2f-001636fd3c1d}]
\Shell\AutoRun\command - G:\ie.exe
\Shell\explore\Command - G:\ie.exe
\Shell\open\Command - G:\ie.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{77d4cbf9-c9b6-11dc-be22-001636fd3c1d}]
\Shell\Auto\command - activexdebugger32.exe f
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
\Shell\explore\Command - activexdebugger32.exe f
\Shell\open\Command - activexdebugger32.exe f

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a6cd033e-9100-11dc-bff6-001636fd3c1d}]
\Shell\Auto\command - H:\activexdebugger32.exe f
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
\Shell\explore\Command - H:\activexdebugger32.exe f
\Shell\open\Command - H:\activexdebugger32.exe f

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a80b645a-a119-11dc-8863-001636fd3c1d}]
\Shell\AutoRun\command - Z:\0hct8ybw.bat
\Shell\explore\Command - Z:\0hct8ybw.bat
\Shell\open\Command - Z:\0hct8ybw.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c63ac7c1-c01e-11dc-8889-001636fd3c1d}]
\Shell\AutoRun\command - G:\ie.exe
\Shell\explore\Command - G:\ie.exe
\Shell\open\Command - G:\ie.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd8665fa-80db-11dc-bfdd-001636fd3c1d}]
\Shell\AutoRun\command - F:\juok3st.bat
\Shell\explore\Command - F:\juok3st.bat
\Shell\open\Command - F:\juok3st.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff481055-5cae-11dc-8d49-bc6517e5f3fc}]
\Shell\AutoRun\command - G:\xo8wr9.exe
\Shell\explore\Command - G:\xo8wr9.exe
\Shell\open\Command - G:\xo8wr9.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
"2008-02-18 15:48:57 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-18 17:32:50
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

.
Completion time: 2008-02-18 17:33:19
ComboFix-quarantined-files.txt 2008-02-18 16:33:17
.
2008-02-15 06:48:36 --- E O F ---
[/b][/b]
ZbiGG
ZbiGG
Forumowicz
Forumowicz
 
Posty: 10
Dołączenie: 18 Lut 2008, 18:37
Miejscowość: Poznań

Postprzez pp3088 » 19 Lut 2008, 12:57

PostUA:


Wklej do Notatnika:

File::
C:\0hct8ybw.bat
C:\WINDOWS\system32\tmp1BA.tmp
C:\WINDOWS\system32\tmp1BB.tmp
C:\WINDOWS\system32\tmp19F.tmp
C:\WINDOWS\system32\tmp19E.tmp
C:\WINDOWS\system32\tmp401.tmp
C:\WINDOWS\system32\tmp400.tmp
C:\WINDOWS\system32\5fc8.sentinel
C:\WINDOWS\Wincfg22c.drt
C:\WINDOWS\system32\amvo.exe
H:\activexdebugger32.exe f
H:\USBNB.exe
G:\3wcxx91.cmd
G:\m.exe
G:\ie.exe
F:\juok3st.bat
G:\xo8wr9.exe

Folder::
C:\swsetup

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]


>>Plik>>Zapisz jako... >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe)
– podobnie jak na tym obrazku -->Image
(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)
Po restarcie usuń ręcznie folder C: \Qoobox.
Po tym nowy log z Combofix.
Awatar użytkownika
pp3088
Aktywny w piśmie
Aktywny w piśmie
 
Posty: 999
Dołączenie: 11 Sie 2006, 23:59
Miejscowość: Szczecin

Postprzez ZbiGG » 19 Lut 2008, 21:04

PostUA:


Zrobiłem, oto nowy log z combofixa




ComboFix 08-02-18.1 - ZbiGG 2008-02-19 19:34:02.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.519 [GMT 1:00]
Running from: C:\Documents and Settings\ZbiGG\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\ZbiGG\Pulpit\CFScript.txt
* Created a new restore point

[b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!


FILE ::
C:\0hct8ybw.bat
C:\WINDOWS\system32\5fc8.sentinel
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\tmp19E.tmp
C:\WINDOWS\system32\tmp19F.tmp
C:\WINDOWS\system32\tmp1BA.tmp
C:\WINDOWS\system32\tmp1BB.tmp
C:\WINDOWS\system32\tmp400.tmp
C:\WINDOWS\system32\tmp401.tmp
C:\WINDOWS\Wincfg22c.drt
F:\juok3st.bat
G:\3wcxx91.cmd
G:\ie.exe
G:\m.exe
G:\xo8wr9.exe
H:\activexdebugger32.exe f
H:\USBNB.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\0hct8ybw.bat
C:\swsetup
C:\swsetup\SP32555\autorun.inf
C:\swsetup\SP32555\CSVer.dll
C:\swsetup\SP32555\InfoDlg.txt
C:\swsetup\SP32555\Install.cfg
C:\swsetup\SP32555\Instngin.dll
C:\swsetup\SP32555\Lang\ARA\CHIPARA.dll
C:\swsetup\SP32555\Lang\ARA\license.txt
C:\swsetup\SP32555\Lang\CHS\CHIPCHS.dll
C:\swsetup\SP32555\Lang\CHS\license.txt
C:\swsetup\SP32555\Lang\CHT\CHIPCHT.dll
C:\swsetup\SP32555\Lang\CHT\license.txt
C:\swsetup\SP32555\Lang\CSY\CHIPCSY.dll
C:\swsetup\SP32555\Lang\CSY\license.txt
C:\swsetup\SP32555\Lang\DAN\CHIPDAN.dll
C:\swsetup\SP32555\Lang\DAN\license.txt
C:\swsetup\SP32555\Lang\DEU\CHIPDEU.dll
C:\swsetup\SP32555\Lang\DEU\license.txt
C:\swsetup\SP32555\Lang\ELL\CHIPELL.dll
C:\swsetup\SP32555\Lang\ELL\license.txt
C:\swsetup\SP32555\Lang\ENU\CHIPENU.dll
C:\swsetup\SP32555\Lang\ENU\license.txt
C:\swsetup\SP32555\Lang\ESN\CHIPESN.dll
C:\swsetup\SP32555\Lang\ESN\license.txt
C:\swsetup\SP32555\Lang\FIN\CHIPFIN.dll
C:\swsetup\SP32555\Lang\FIN\license.txt
C:\swsetup\SP32555\Lang\FRA\CHIPFRA.dll
C:\swsetup\SP32555\Lang\FRA\license.txt
C:\swsetup\SP32555\Lang\HEB\CHIPHEB.dll
C:\swsetup\SP32555\Lang\HEB\license.txt
C:\swsetup\SP32555\Lang\HUN\CHIPHUN.dll
C:\swsetup\SP32555\Lang\HUN\license.txt
C:\swsetup\SP32555\Lang\ITA\CHIPITA.dll
C:\swsetup\SP32555\Lang\ITA\license.txt
C:\swsetup\SP32555\Lang\JPN\CHIPJPN.dll
C:\swsetup\SP32555\Lang\JPN\license.txt
C:\swsetup\SP32555\Lang\KOR\CHIPKOR.dll
C:\swsetup\SP32555\Lang\KOR\license.txt
C:\swsetup\SP32555\Lang\NLD\CHIPNLD.dll
C:\swsetup\SP32555\Lang\NLD\license.txt
C:\swsetup\SP32555\Lang\NOR\CHIPNOR.dll
C:\swsetup\SP32555\Lang\NOR\license.txt
C:\swsetup\SP32555\Lang\PLK\CHIPPLK.dll
C:\swsetup\SP32555\Lang\PLK\license.txt
C:\swsetup\SP32555\Lang\PTB\CHIPPTB.dll
C:\swsetup\SP32555\Lang\PTB\license.txt
C:\swsetup\SP32555\Lang\PTG\CHIPPTG.dll
C:\swsetup\SP32555\Lang\PTG\license.txt
C:\swsetup\SP32555\Lang\RUS\CHIPRUS.dll
C:\swsetup\SP32555\Lang\RUS\license.txt
C:\swsetup\SP32555\Lang\SVE\CHIPSVE.dll
C:\swsetup\SP32555\Lang\SVE\license.txt
C:\swsetup\SP32555\Lang\THA\CHIPTHA.dll
C:\swsetup\SP32555\Lang\THA\license.txt
C:\swsetup\SP32555\Lang\TRK\CHIPTRK.dll
C:\swsetup\SP32555\Lang\TRK\license.txt
C:\swsetup\SP32555\readme.txt
C:\swsetup\SP32555\Setup.exe
C:\swsetup\SP32555\UpDrv64.exe
C:\swsetup\SP32555\win2000\852.cat
C:\swsetup\SP32555\win2000\852.inf
C:\swsetup\SP32555\win2000\855.cat
C:\swsetup\SP32555\win2000\855.inf
C:\swsetup\SP32555\win2000\865.cat
C:\swsetup\SP32555\win2000\865.inf
C:\swsetup\SP32555\win2000\915.cat
C:\swsetup\SP32555\win2000\915.inf
C:\swsetup\SP32555\win2000\915M.cat
C:\swsetup\SP32555\win2000\915M.inf
C:\swsetup\SP32555\win2000\945.cat
C:\swsetup\SP32555\win2000\945.inf
C:\swsetup\SP32555\win2000\945gm.cat
C:\swsetup\SP32555\win2000\945GM.inf
C:\swsetup\SP32555\win2000\dmi_pci.cat
C:\swsetup\SP32555\win2000\dmi_pci.inf
C:\swsetup\SP32555\win2000\E7220.cat
C:\swsetup\SP32555\win2000\E7220.inf
C:\swsetup\SP32555\win2000\e7230.cat
C:\swsetup\SP32555\win2000\E7230.inf
C:\swsetup\SP32555\win2000\E7520.cat
C:\swsetup\SP32555\win2000\E7520.inf
C:\swsetup\SP32555\win2000\E8500.cat
C:\swsetup\SP32555\win2000\E8500.inf
C:\swsetup\SP32555\win2000\ich4core.cat
C:\swsetup\SP32555\win2000\ich4core.inf
C:\swsetup\SP32555\win2000\ich4ide.cat
C:\swsetup\SP32555\win2000\ich4ide.inf
C:\swsetup\SP32555\win2000\ich4usb.cat
C:\swsetup\SP32555\win2000\ich4usb.inf
C:\swsetup\SP32555\win2000\ich5core.cat
C:\swsetup\SP32555\win2000\ich5core.inf
C:\swsetup\SP32555\win2000\ich5ide.cat
C:\swsetup\SP32555\win2000\ich5ide.inf
C:\swsetup\SP32555\win2000\ich5usb.cat
C:\swsetup\SP32555\win2000\ich5usb.inf
C:\swsetup\SP32555\win2000\ich6core.cat
C:\swsetup\SP32555\win2000\ich6core.inf
C:\swsetup\SP32555\win2000\ich6ide.cat
C:\swsetup\SP32555\win2000\ich6ide.inf
C:\swsetup\SP32555\win2000\ich6usb.cat
C:\swsetup\SP32555\win2000\ich6usb.inf
C:\swsetup\SP32555\win2000\ich7core.cat
C:\swsetup\SP32555\win2000\ich7core.inf
C:\swsetup\SP32555\win2000\ich7id2.cat
C:\swsetup\SP32555\win2000\ich7id2.inf
C:\swsetup\SP32555\win2000\ich7usb.cat
C:\swsetup\SP32555\win2000\ich7usb.inf
C:\swsetup\SP32555\win2000\ichxdev.cat
C:\swsetup\SP32555\win2000\ichXdev.inf
C:\swsetup\SP32555\win2000\infanswr.txt
C:\swsetup\SP32555\win2000\SP\ich4id2.cat
C:\swsetup\SP32555\win2000\SP\ich4id2.inf
C:\swsetup\SP32555\win2000\SP\ich5id2.cat
C:\swsetup\SP32555\win2000\SP\ich5id2.inf
C:\swsetup\SP32555\win2000\SP\ich6id2.cat
C:\swsetup\SP32555\win2000\SP\ich6id2.inf
C:\swsetup\SP32555\win2000\SP\ich7id2.cat
C:\swsetup\SP32555\win2000\SP\ich7id2.inf
C:\swsetup\SP32555\win2003\865.cat
C:\swsetup\SP32555\win2003\865.inf
C:\swsetup\SP32555\win2003\915.cat
C:\swsetup\SP32555\win2003\915.inf
C:\swsetup\SP32555\win2003\915M.cat
C:\swsetup\SP32555\win2003\915M.inf
C:\swsetup\SP32555\win2003\945.cat
C:\swsetup\SP32555\win2003\945.inf
C:\swsetup\SP32555\win2003\945gm.cat
C:\swsetup\SP32555\win2003\945GM.inf
C:\swsetup\SP32555\win2003\dmi_pci.cat
C:\swsetup\SP32555\win2003\dmi_pci.inf
C:\swsetup\SP32555\win2003\E7220.cat
C:\swsetup\SP32555\win2003\E7220.inf
C:\swsetup\SP32555\win2003\e7230.cat
C:\swsetup\SP32555\win2003\E7230.inf
C:\swsetup\SP32555\win2003\E7520.cat
C:\swsetup\SP32555\win2003\E7520.inf
C:\swsetup\SP32555\win2003\E8500.cat
C:\swsetup\SP32555\win2003\E8500.inf
C:\swsetup\SP32555\win2003\ich5core.cat
C:\swsetup\SP32555\win2003\ich5core.inf
C:\swsetup\SP32555\win2003\ich5ide.cat
C:\swsetup\SP32555\win2003\ich5ide.inf
C:\swsetup\SP32555\win2003\ich5usb.cat
C:\swsetup\SP32555\win2003\ich5usb.inf
C:\swsetup\SP32555\win2003\ich6core.cat
C:\swsetup\SP32555\win2003\ich6core.inf
C:\swsetup\SP32555\win2003\ich6ide.cat
C:\swsetup\SP32555\win2003\ich6ide.inf
C:\swsetup\SP32555\win2003\ich6usb.cat
C:\swsetup\SP32555\win2003\ich6usb.inf
C:\swsetup\SP32555\win2003\ich7core.cat
C:\swsetup\SP32555\win2003\ich7core.inf
C:\swsetup\SP32555\win2003\ich7id2.cat
C:\swsetup\SP32555\win2003\ich7id2.inf
C:\swsetup\SP32555\win2003\ich7usb.cat
C:\swsetup\SP32555\win2003\ich7usb.inf
C:\swsetup\SP32555\win2003\ichxdev.cat
C:\swsetup\SP32555\win2003\ichXdev.inf
C:\swsetup\SP32555\win2003\infanswr.txt
C:\swsetup\SP32555\win2003\SP\ich5id2.cat
C:\swsetup\SP32555\win2003\SP\ich5id2.inf
C:\swsetup\SP32555\win2003\SP\ich6id2.cat
C:\swsetup\SP32555\win2003\SP\ich6id2.inf
C:\swsetup\SP32555\win2003\SP\ich7id2.cat
C:\swsetup\SP32555\win2003\SP\ich7id2.inf
C:\swsetup\SP32555\XP\852.cat
C:\swsetup\SP32555\XP\852.inf
C:\swsetup\SP32555\XP\855.cat
C:\swsetup\SP32555\XP\855.inf
C:\swsetup\SP32555\XP\865.cat
C:\swsetup\SP32555\XP\865.inf
C:\swsetup\SP32555\XP\915.cat
C:\swsetup\SP32555\XP\915.inf
C:\swsetup\SP32555\XP\915M.cat
C:\swsetup\SP32555\XP\915M.inf
C:\swsetup\SP32555\XP\945.cat
C:\swsetup\SP32555\XP\945.inf
C:\swsetup\SP32555\XP\945gm.cat
C:\swsetup\SP32555\XP\945GM.inf
C:\swsetup\SP32555\XP\dmi_pci.cat
C:\swsetup\SP32555\XP\dmi_pci.inf
C:\swsetup\SP32555\XP\E7220.cat
C:\swsetup\SP32555\XP\E7220.inf
C:\swsetup\SP32555\XP\e7230.cat
C:\swsetup\SP32555\XP\E7230.inf
C:\swsetup\SP32555\XP\E7520.cat
C:\swsetup\SP32555\XP\E7520.inf
C:\swsetup\SP32555\XP\E8500.cat
C:\swsetup\SP32555\XP\E8500.inf
C:\swsetup\SP32555\XP\ich4core.cat
C:\swsetup\SP32555\XP\ich4core.inf
C:\swsetup\SP32555\XP\ich4ide.cat
C:\swsetup\SP32555\XP\ich4ide.inf
C:\swsetup\SP32555\XP\ich4usb.cat
C:\swsetup\SP32555\XP\ich4usb.inf
C:\swsetup\SP32555\XP\ich5core.cat
C:\swsetup\SP32555\XP\ich5core.inf
C:\swsetup\SP32555\XP\ich5ide.cat
C:\swsetup\SP32555\XP\ich5ide.inf
C:\swsetup\SP32555\XP\ich5usb.cat
C:\swsetup\SP32555\XP\ich5usb.inf
C:\swsetup\SP32555\XP\ich6core.cat
C:\swsetup\SP32555\XP\ich6core.inf
C:\swsetup\SP32555\XP\ich6ide.cat
C:\swsetup\SP32555\XP\ich6ide.inf
C:\swsetup\SP32555\XP\ich6usb.cat
C:\swsetup\SP32555\XP\ich6usb.inf
C:\swsetup\SP32555\XP\ich7core.cat
C:\swsetup\SP32555\XP\ich7core.inf
C:\swsetup\SP32555\XP\ich7id2.cat
C:\swsetup\SP32555\XP\ich7id2.inf
C:\swsetup\SP32555\XP\ich7usb.cat
C:\swsetup\SP32555\XP\ich7usb.inf
C:\swsetup\SP32555\XP\ichxdev.cat
C:\swsetup\SP32555\XP\ichXdev.inf
C:\swsetup\SP32555\XP\INFAnswr.txt
C:\swsetup\SP32555\XP\SP\ich4id2.cat
C:\swsetup\SP32555\XP\SP\ich4ide.cat
C:\swsetup\SP32555\XP\SP\ich5id2.cat
C:\swsetup\SP32555\XP\SP\ich5id2.inf
C:\swsetup\SP32555\XP\SP\ich6id2.cat
C:\swsetup\SP32555\XP\SP\ich6id2.inf
C:\swsetup\SP32555\XP\SP\ich7id2.cat
C:\swsetup\SP32555\XP\SP\ich7id2.inf
C:\swsetup\SP32883A\0x0404.ini
C:\swsetup\SP32883A\0x0406.ini
C:\swsetup\SP32883A\0x0407.ini
C:\swsetup\SP32883A\0x0409.ini
C:\swsetup\SP32883A\0x040a.ini
C:\swsetup\SP32883A\0x040b.ini
C:\swsetup\SP32883A\0x040c.ini
C:\swsetup\SP32883A\0x0410.ini
C:\swsetup\SP32883A\0x0411.ini
C:\swsetup\SP32883A\0x0412.ini
C:\swsetup\SP32883A\0x0413.ini
C:\swsetup\SP32883A\0x0414.ini
C:\swsetup\SP32883A\0x0415.ini
C:\swsetup\SP32883A\0x0416.ini
C:\swsetup\SP32883A\0x0419.ini
C:\swsetup\SP32883A\0x041d.ini
C:\swsetup\SP32883A\0x0804.ini
C:\swsetup\SP32883A\1028.mst
C:\swsetup\SP32883A\1030.mst
C:\swsetup\SP32883A\1031.mst
C:\swsetup\SP32883A\1033.mst
C:\swsetup\SP32883A\1034.mst
C:\swsetup\SP32883A\1035.mst
C:\swsetup\SP32883A\1036.mst
C:\swsetup\SP32883A\1040.mst
C:\swsetup\SP32883A\1041.mst
C:\swsetup\SP32883A\1042.mst
C:\swsetup\SP32883A\1043.mst
C:\swsetup\SP32883A\1044.mst
C:\swsetup\SP32883A\1045.mst
C:\swsetup\SP32883A\1046.mst
C:\swsetup\SP32883A\1049.mst
C:\swsetup\SP32883A\1053.mst
C:\swsetup\SP32883A\2052.mst
C:\swsetup\SP32883A\Autorun.inf
C:\swsetup\SP32883A\BBalloon.dll
C:\swsetup\SP32883A\BtSetup.dll
C:\swsetup\SP32883A\btw.ico
C:\swsetup\SP32883A\BTW.msi
C:\swsetup\SP32883A\btw_ci.dll
C:\swsetup\SP32883A\btwusb.cat
C:\swsetup\SP32883A\btwusb.inf
C:\swsetup\SP32883A\btwusb.sys
C:\swsetup\SP32883A\CustomBr.ctm
C:\swsetup\SP32883A\CustomCs.ctm
C:\swsetup\SP32883A\CustomCt.ctm
C:\swsetup\SP32883A\CustomDa.ctm
C:\swsetup\SP32883A\CustomDu.ctm
C:\swsetup\SP32883A\CustomEn.ctm
C:\swsetup\SP32883A\CustomFi.ctm
C:\swsetup\SP32883A\CustomFr.ctm
C:\swsetup\SP32883A\CustomGr.ctm
C:\swsetup\SP32883A\CustomIt.ctm
C:\swsetup\SP32883A\CustomJp.ctm
C:\swsetup\SP32883A\CustomKo.ctm
C:\swsetup\SP32883A\CustomNo.ctm
C:\swsetup\SP32883A\CustomPo.ctm
C:\swsetup\SP32883A\CustomRu.ctm
C:\swsetup\SP32883A\CustomSp.ctm
C:\swsetup\SP32883A\CustomSw.ctm
C:\swsetup\SP32883A\Data1.cab
C:\swsetup\SP32883A\frmupgr.sys
C:\swsetup\SP32883A\Inst.exe
C:\swsetup\SP32883A\instmsia.exe
C:\swsetup\SP32883A\instmsiw.exe
C:\swsetup\SP32883A\license.dat
C:\swsetup\SP32883A\MSVCP60.DLL
C:\swsetup\SP32883A\setup.exe
C:\swsetup\SP32883A\Setup.ini
C:\swsetup\SP32883A\setup2k.iss
C:\swsetup\SP32883A\setupXp.iss
C:\swsetup\SP32883A\SP32883.cva
C:\swsetup\SP32883A\svcpack\SvcPack.ini
C:\swsetup\SP32899\Advanced.tv_
C:\swsetup\SP32899\CAD.tv_
C:\swsetup\SP32899\data1.cab
C:\swsetup\SP32899\data1.hdr
C:\swsetup\SP32899\data2.cab
C:\swsetup\SP32899\DCC.tv_
C:\swsetup\SP32899\default.tv_
C:\swsetup\SP32899\engine32.cab
C:\swsetup\SP32899\Finance.tv_
C:\swsetup\SP32899\keystone.ex_
C:\swsetup\SP32899\layout.bin
C:\swsetup\SP32899\modes.txt
C:\swsetup\SP32899\nv4_disp.dl_
C:\swsetup\SP32899\nv4_mini.sy_
C:\swsetup\SP32899\nvapi.dl_
C:\swsetup\SP32899\nvappbar.ex_
C:\swsetup\SP32899\NvApps.xm_
C:\swsetup\SP32899\nvbl.cat
C:\swsetup\SP32899\NVBL.INF
C:\swsetup\SP32899\nvcod.dl_
C:\swsetup\SP32899\NVCPAR.HL_
C:\swsetup\SP32899\NVCPCS.HL_
C:\swsetup\SP32899\NVCPDA.HL_
C:\swsetup\SP32899\NVCPDE.HL_
C:\swsetup\SP32899\NVCPEL.HL_
C:\swsetup\SP32899\NVCPENG.HL_
C:\swsetup\SP32899\NVCPES.HL_
C:\swsetup\SP32899\NVCPFI.HL_
C:\swsetup\SP32899\NVCPFR.HL_
C:\swsetup\SP32899\NVCPHE.HL_
C:\swsetup\SP32899\NVCPHU.HL_
C:\swsetup\SP32899\NVCPIT.HL_
C:\swsetup\SP32899\NVCPJA.HL_
C:\swsetup\SP32899\NVCPKO.HL_
C:\swsetup\SP32899\NvCpl.dl_
C:\swsetup\SP32899\NVCPL.HL_
C:\swsetup\SP32899\NVCPNL.HL_
C:\swsetup\SP32899\NVCPNO.HL_
C:\swsetup\SP32899\NVCPPL.HL_
C:\swsetup\SP32899\NVCPPT.HL_
C:\swsetup\SP32899\NVCPPTB.HL_
C:\swsetup\SP32899\NVCPRU.HL_
C:\swsetup\SP32899\NVCPSK.HL_
C:\swsetup\SP32899\NVCPSL.HL_
C:\swsetup\SP32899\NVCPSV.HL_
C:\swsetup\SP32899\NVCPTH.HL_
C:\swsetup\SP32899\NVCPTR.HL_
C:\swsetup\SP32899\NVCPZHC.HL_
C:\swsetup\SP32899\NVCPZHT.HL_
C:\swsetup\SP32899\NVDisp.nvu
C:\swsetup\SP32899\nvdspsch.ex_
C:\swsetup\SP32899\nview.dl_
C:\swsetup\SP32899\NvMCTray.dl_
C:\swsetup\SP32899\nvoglnt.dl_
C:\swsetup\SP32899\NVRSAR.dl_
C:\swsetup\SP32899\NVRSCS.dl_
C:\swsetup\SP32899\NVRSDA.dl_
C:\swsetup\SP32899\NVRSDE.dl_
C:\swsetup\SP32899\NVRSEL.dl_
C:\swsetup\SP32899\NVRSENG.dl_
C:\swsetup\SP32899\NVRSES.dl_
C:\swsetup\SP32899\NVRSFI.dl_
C:\swsetup\SP32899\NVRSFR.dl_
C:\swsetup\SP32899\NVRSHE.dl_
C:\swsetup\SP32899\NVRSHU.dl_
C:\swsetup\SP32899\NVRSIT.dl_
C:\swsetup\SP32899\NVRSJA.dl_
C:\swsetup\SP32899\NVRSKO.dl_
C:\swsetup\SP32899\NVRSNL.dl_
C:\swsetup\SP32899\NVRSNO.dl_
C:\swsetup\SP32899\NVRSPL.dl_
C:\swsetup\SP32899\NVRSPT.dl_
C:\swsetup\SP32899\NVRSPTB.dl_
C:\swsetup\SP32899\NVRSRU.dl_
C:\swsetup\SP32899\NVRSSK.dl_
C:\swsetup\SP32899\NVRSSL.dl_
C:\swsetup\SP32899\NVRSSV.dl_
C:\swsetup\SP32899\NVRSTR.dl_
C:\swsetup\SP32899\NVRSZHC.dl_
C:\swsetup\SP32899\NVRSZHT.dl_
C:\swsetup\SP32899\nvshell.dl_
C:\swsetup\SP32899\nvsvc32.ex_
C:\swsetup\SP32899\nvtuicpl.cp_
C:\swsetup\SP32899\nvudisp.exe
C:\swsetup\SP32899\nvwcpar.hl_
C:\swsetup\SP32899\nvwcpcs.hl_
C:\swsetup\SP32899\nvwcpda.hl_
C:\swsetup\SP32899\nvwcpde.hl_
C:\swsetup\SP32899\nvwcpel.hl_
C:\swsetup\SP32899\nvwcpeng.hl_
C:\swsetup\SP32899\nvwcpes.hl_
C:\swsetup\SP32899\nvwcpfi.hl_
C:\swsetup\SP32899\nvwcpfr.hl_
C:\swsetup\SP32899\nvwcphe.hl_
C:\swsetup\SP32899\nvwcphu.hl_
C:\swsetup\SP32899\nvwcpit.hl_
C:\swsetup\SP32899\nvwcpja.hl_
C:\swsetup\SP32899\nvwcpko.hl_
C:\swsetup\SP32899\nvwcplen.hl_
C:\swsetup\SP32899\nvwcpnl.hl_
C:\swsetup\SP32899\nvwcpno.hl_
C:\swsetup\SP32899\nvwcppl.hl_
C:\swsetup\SP32899\nvwcppt.hl_
C:\swsetup\SP32899\nvwcpptb.hl_
C:\swsetup\SP32899\nvwcpru.hl_
C:\swsetup\SP32899\nvwcpsk.hl_
C:\swsetup\SP32899\nvwcpsl.hl_
C:\swsetup\SP32899\nvwcpsv.hl_
C:\swsetup\SP32899\nvwcpth.hl_
C:\swsetup\SP32899\nvwcptr.hl_
C:\swsetup\SP32899\nvwcpzhc.hl_
C:\swsetup\SP32899\nvwcpzht.hl_
C:\swsetup\SP32899\nvwddi.dl_
C:\swsetup\SP32899\nvwdmcpl.dl_
C:\swsetup\SP32899\nvwimg.dl_
C:\swsetup\SP32899\nvwrsar.dl_
C:\swsetup\SP32899\nvwrscs.dl_
C:\swsetup\SP32899\nvwrsda.dl_
C:\swsetup\SP32899\nvwrsde.dl_
C:\swsetup\SP32899\nvwrsel.dl_
C:\swsetup\SP32899\nvwrseng.dl_
C:\swsetup\SP32899\nvwrses.dl_
C:\swsetup\SP32899\nvwrsfi.dl_
C:\swsetup\SP32899\nvwrsfr.dl_
C:\swsetup\SP32899\nvwrshe.dl_
C:\swsetup\SP32899\nvwrshu.dl_
C:\swsetup\SP32899\nvwrsit.dl_
C:\swsetup\SP32899\nvwrsja.dl_
C:\swsetup\SP32899\nvwrsko.dl_
C:\swsetup\SP32899\nvwrsnl.dl_
C:\swsetup\SP32899\nvwrsno.dl_
C:\swsetup\SP32899\nvwrspl.dl_
C:\swsetup\SP32899\nvwrspt.dl_
C:\swsetup\SP32899\nvwrsptb.dl_
C:\swsetup\SP32899\nvwrsru.dl_
C:\swsetup\SP32899\nvwrssk.dl_
C:\swsetup\SP32899\nvwrssl.dl_
C:\swsetup\SP32899\nvwrssv.dl_
C:\swsetup\SP32899\nvwrstr.dl_
C:\swsetup\SP32899\nvwrszhc.dl_
C:\swsetup\SP32899\nvwrszht.dl_
C:\swsetup\SP32899\NvwsApps.xm_
C:\swsetup\SP32899\nwiz.ex_
C:\swsetup\SP32899\setup.bmp
C:\swsetup\SP32899\setup.exe
C:\swsetup\SP32899\setup.ibt
C:\swsetup\SP32899\setup.ini
C:\swsetup\SP32899\setup.inx
C:\swsetup\SP32899\setup.iss
C:\swsetup\SP32899\setup.skin
C:\swsetup\SP32899\SP32899.CVA
C:\swsetup\SP33258\Disk1\data1.cab
C:\swsetup\SP33258\Disk1\data1.hdr
C:\swsetup\SP33258\Disk1\data2.cab
C:\swsetup\SP33258\Disk1\engine32.cab
C:\swsetup\SP33258\Disk1\layout.bin
C:\swsetup\SP33258\Disk1\setup.exe
C:\swsetup\SP33258\Disk1\setup.ibt
C:\swsetup\SP33258\Disk1\setup.ini
C:\swsetup\SP33258\Disk1\setup.inx
C:\swsetup\SP33258\Disk1\setup.iss
C:\swsetup\SP33258\SP33258.CVA
C:\swsetup\SP33544\RbtMsg.exe
C:\swsetup\SP33544\setup.bat
C:\swsetup\SP33544\SP33544.CVA
C:\swsetup\SP33574A\apps\setup\setupbd\w98-ws32\Inst98.dll
C:\swsetup\SP33574A\apps\setup\setupbd\w98-ws32\NetInst.dll
C:\swsetup\SP33574A\apps\setup\setupbd\w98-ws32\SetBDRes.dll
C:\swsetup\SP33574A\apps\setup\setupbd\w98-ws32\SetupBD.din
C:\swsetup\SP33574A\apps\setup\setupbd\w98-ws32\SetupBD.exe
C:\swsetup\SP33574A\apps\setup\setupbd\w98-ws32\SetupBD.ini
C:\swsetup\SP33574A\e1000325.cat
C:\swsetup\SP33574A\e1000325.din
C:\swsetup\SP33574A\e1000325.inf
C:\swsetup\SP33574A\E1000325.sys
C:\swsetup\SP33574A\e1000msg.dll
C:\swsetup\SP33574A\e1000nt5.din
C:\swsetup\SP33574A\E1000NT5.SYS
C:\swsetup\SP33574A\e1e5032.din
C:\swsetup\SP33574A\E1e5032.SYS
C:\swsetup\SP33574A\E1E5132.CAT
C:\swsetup\SP33574A\e1e5132.din
C:\swsetup\SP33574A\E1E5132.INF
C:\swsetup\SP33574A\E1e5132.sys
C:\swsetup\SP33574A\NicCo.dll
C:\swsetup\SP33574A\NicEtCo.dll
C:\swsetup\SP33574A\NicInst.dll
C:\swsetup\SP33574A\PRO1000\WIN98SE\8255xdel.exe
C:\swsetup\SP33574A\PRO1000\WIN98SE\e1000w9x.din
C:\swsetup\SP33574A\PRO1000\WIN98SE\e1000w9x.inf
C:\swsetup\SP33574A\PRO1000\WIN98SE\e1000w9x.sys
C:\swsetup\SP33574A\PRO1000\WS03XP2K\e1000325.cat
C:\swsetup\SP33574A\PRO1000\WS03XP2K\e1000325.din
C:\swsetup\SP33574A\PRO1000\WS03XP2K\e1000325.inf
C:\swsetup\SP33574A\PRO1000\WS03XP2K\E1000325.sys
C:\swsetup\SP33574A\PRO1000\WS03XP2K\e1000msg.dll
C:\swsetup\SP33574A\PRO1000\WS03XP2K\e1000nt5.din
C:\swsetup\SP33574A\PRO1000\WS03XP2K\E1000NT5.SYS
C:\swsetup\SP33574A\PRO1000\WS03XP2K\e1e5032.din
C:\swsetup\SP33574A\PRO1000\WS03XP2K\E1e5032.SYS
C:\swsetup\SP33574A\PRO1000\WS03XP2K\E1E5132.CAT
C:\swsetup\SP33574A\PRO1000\WS03XP2K\e1e5132.din
C:\swsetup\SP33574A\PRO1000\WS03XP2K\E1E5132.INF
C:\swsetup\SP33574A\PRO1000\WS03XP2K\E1e5132.sys
C:\swsetup\SP33574A\PRO1000\WS03XP2K\NicCo.dll
C:\swsetup\SP33574A\PRO1000\WS03XP2K\NicEtCo.dll
C:\swsetup\SP33574A\PRO1000\WS03XP2K\NicInst.dll
C:\swsetup\SP33574A\PRO1000\WS03XP2K\PROUnstl.exe
C:\swsetup\SP33574A\PRO1000\WS03XP2K\RIS_INF\e1000325.zip
C:\swsetup\SP33574A\PRO1000\WS03XP2K\RIS_INF\e1000nt5.zip
C:\swsetup\SP33574A\PRO1000\WS03XP2K\RIS_INF\e1e5032.zip
C:\swsetup\SP33574A\PRO1000\WS03XP2K\RIS_INF\E1E5132.ZIP
C:\swsetup\SP33574A\PRO1000\WS03XP2K\RIS_INF\readme.txt
C:\swsetup\SP33574A\PROUnstl.exe
C:\swsetup\SP33574A\SP33574.CVA
C:\swsetup\SP33604\data1.cab
C:\swsetup\SP33604\data1.hdr
C:\swsetup\SP33604\data2.cab
C:\swsetup\SP33604\engine32.cab
C:\swsetup\SP33604\layout.bin
C:\swsetup\SP33604\MMC\rimmptsk.cat
C:\swsetup\SP33604\MMC\Rimmptsk.inf
C:\swsetup\SP33604\MMC\rimmptsk.sys
C:\swsetup\SP33604\MS\rimsptsk.cat
C:\swsetup\SP33604\MS\rimsptsk.inf
C:\swsetup\SP33604\MS\Rimsptsk.sys
C:\swsetup\SP33604\MS\snymsico.dll
C:\swsetup\SP33604\setup.boot
C:\swsetup\SP33604\setup.exe
C:\swsetup\SP33604\setup.ini
C:\swsetup\SP33604\setup.inx
C:\swsetup\SP33604\setup.iss
C:\swsetup\SP33604\SP33604.cva
C:\swsetup\SP33604\XD\RixDICON.dll
C:\swsetup\SP33604\XD\rixdptsk.cat
C:\swsetup\SP33604\XD\rixdptsk.inf
C:\swsetup\SP33604\XD\Rixdptsk.sys
C:\swsetup\SP33867\Disk1\data1.cab
C:\swsetup\SP33867\Disk1\data1.hdr
C:\swsetup\SP33867\Disk1\data2.cab
C:\swsetup\SP33867\Disk1\engine32.cab
C:\swsetup\SP33867\Disk1\layout.bin
C:\swsetup\SP33867\Disk1\setup.boot
C:\swsetup\SP33867\Disk1\setup.exe
C:\swsetup\SP33867\Disk1\setup.ini
C:\swsetup\SP33867\Disk1\setup.inx
C:\swsetup\SP33867\Disk1\setup.iss
C:\swsetup\SP33867\Disk1\vssver.scc
C:\swsetup\SP33867\SP33867.CVA
C:\swsetup\SP33890\at8ven5m.cat
C:\swsetup\SP33890\At8VEN5m.inf
C:\swsetup\SP33890\At8VEN5m.ini
C:\swsetup\SP33890\disk1
C:\swsetup\SP33890\HSF_CNXT.sys
C:\swsetup\SP33890\HSF_DPV.sys
C:\swsetup\SP33890\HSFHWAZL.sys
C:\swsetup\SP33890\HSFProf.cty
C:\swsetup\SP33890\HXFSetup.exe
C:\swsetup\SP33890\MdmXSdk.dll
C:\swsetup\SP33890\MDMXSDK.sys
C:\swsetup\SP33890\Netwaiting\custom.ini
C:\swsetup\SP33890\Netwaiting\data1.cab
C:\swsetup\SP33890\Netwaiting\data1.hdr
C:\swsetup\SP33890\Netwaiting\data2.cab
C:\swsetup\SP33890\Netwaiting\ikernel.ex_
C:\swsetup\SP33890\Netwaiting\language.dat
C:\swsetup\SP33890\Netwaiting\Language\ARB\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\ARB\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\ARB\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\ARB\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\ARB\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\CHS\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\CHS\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\CHS\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\CHS\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\CHS\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\CHT\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\CHT\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\CHT\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\CHT\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\CHT\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\CSY\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\CSY\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\CSY\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\CSY\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\CSY\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\DAN\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\DAN\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\DAN\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\DAN\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\DAN\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\DEU\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\DEU\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\DEU\Licence.txt
C:\swsetup\SP33890\Netwaiting\Language\DEU\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\DEU\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\ELL\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\ELL\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\ELL\Licence.txt
C:\swsetup\SP33890\Netwaiting\Language\ELL\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\ELL\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\ENU\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\ENU\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\ENU\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\ENU\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\ENU\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\ESP\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\ESP\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\ESP\Licence.txt
C:\swsetup\SP33890\Netwaiting\Language\ESP\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\ESP\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\FIN\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\FIN\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\FIN\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\FIN\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\FIN\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\FRA\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\FRA\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\FRA\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\FRA\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\FRA\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\HEB\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\HEB\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\HEB\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\HEB\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\HEB\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\HUN\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\HUN\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\HUN\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\HUN\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\HUN\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\ITA\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\ITA\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\ITA\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\ITA\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\ITA\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\JPN\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\JPN\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\JPN\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\JPN\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\JPN\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\KOR\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\KOR\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\KOR\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\KOR\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\KOR\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\NLD\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\NLD\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\NLD\Licence.txt
C:\swsetup\SP33890\Netwaiting\Language\NLD\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\NLD\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\NOR\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\NOR\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\NOR\Licence.txt
C:\swsetup\SP33890\Netwaiting\Language\NOR\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\NOR\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\PLK\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\PLK\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\PLK\Licence.txt
C:\swsetup\SP33890\Netwaiting\Language\PLK\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\PLK\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\PTB\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\PTB\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\PTB\Licence.txt
C:\swsetup\SP33890\Netwaiting\Language\PTB\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\PTB\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\PTG\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\PTG\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\PTG\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\PTG\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\PTG\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\RUS\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\RUS\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\RUS\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\RUS\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\RUS\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\SKY\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\SKY\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\SKY\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\SKY\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\SKY\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\SLV\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\SLV\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\SLV\Licence.txt
C:\swsetup\SP33890\Netwaiting\Language\SLV\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\SLV\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\SVE\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\SVE\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\SVE\Licence.txt
C:\swsetup\SP33890\Netwaiting\Language\SVE\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\SVE\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\THA\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\THA\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\THA\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\THA\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\THA\NetWait.chm
C:\swsetup\SP33890\Netwaiting\Language\TRK\Aboutn.dll
C:\swsetup\SP33890\Netwaiting\Language\TRK\aboutn.ini
C:\swsetup\SP33890\Netwaiting\Language\TRK\licence.txt
C:\swsetup\SP33890\Netwaiting\Language\TRK\mohrc.dll
C:\swsetup\SP33890\Netwaiting\Language\TRK\NetWait.chm
C:\swsetup\SP33890\Netwaiting\layout.bin
C:\swsetup\SP33890\Netwaiting\Releases.txt
C:\swsetup\SP33890\Netwaiting\setup.bjb
C:\swsetup\SP33890\Netwaiting\Setup.bmp
C:\swsetup\SP33890\Netwaiting\Setup.exe
C:\swsetup\SP33890\Netwaiting\Setup.ini
C:\swsetup\SP33890\Netwaiting\setup.inx
C:\swsetup\SP33890\Netwaiting\setup.iss
C:\swsetup\SP33890\Netwaiting\ver.txt
C:\swsetup\SP33890\Setup.exe
C:\swsetup\SP33890\SP33890.CVA
C:\swsetup\SP33890\SP33890.txt
C:\swsetup\SP33890\UCI32108.dll
C:\swsetup\SP33890\UIUDLL.dll
C:\swsetup\SP33890\UIUSYS.sys
C:\swsetup\SP33890\WSSP33890.txt
C:\swsetup\SP34204\at8ven5a.cat
C:\swsetup\SP34204\At8VEN5a.inf
C:\swsetup\SP34204\At8VEN5a.ini
C:\swsetup\SP34204\CHDAud.sys
C:\swsetup\SP34204\chdaudprop.DLL
C:\swsetup\SP34204\chdaudpropres.DLL
C:\swsetup\SP34204\CHDAudPropShortcut.exe
C:\swsetup\SP34204\disk1
C:\swsetup\SP34204\HXFSetup.exe
C:\swsetup\SP34204\Setup.exe
C:\swsetup\SP34204\SP34204.CVA
C:\swsetup\SP34204\SP34204.txt
C:\swsetup\SP34204\UCI32105.dll
C:\swsetup\SP34204\UIUDLL.dll
C:\swsetup\SP34204\UIUSYS.sys
C:\swsetup\SP34204\WSSP34204.txt
C:\swsetup\SP34489A\comp.ini
C:\swsetup\SP34489A\DPInst.EXE
C:\swsetup\SP34489A\DPInst64.exe
C:\swsetup\SP34489A\iProdifx.dll
C:\swsetup\SP34489A\iProdifx.EXE
C:\swsetup\SP34489A\iwlandrvxpver.dll
C:\swsetup\SP34489A\NETw2c32.DLL
C:\swsetup\SP34489A\NETw2c64.DLL
C:\swsetup\SP34489A\NETw2r32.DLL
C:\swsetup\SP34489A\NETw2r64.DLL
C:\swsetup\SP34489A\NETw39x5.CAT
C:\swsetup\SP34489A\NETw39x5.inf
C:\swsetup\SP34489A\NETw3c32.DLL
C:\swsetup\SP34489A\NETw3c64.DLL
C:\swsetup\SP34489A\NETw3k32.sys
C:\swsetup\SP34489A\NETw3r32.DLL
C:\swsetup\SP34489A\NETw3r64.DLL
C:\swsetup\SP34489A\NETw3x32.sys
C:\swsetup\SP34489A\NETw3x64.sys
C:\swsetup\SP34489A\Sinstall.exe
C:\swsetup\SP34489A\Sinstall.ini
C:\swsetup\SP34489A\sp34489.cva
C:\swsetup\SP34489A\w29n50.sys
C:\swsetup\SP34489A\w29n51.cat
C:\swsetup\SP34489A\w29n51.inf
C:\swsetup\SP34489A\w29n51.sys
C:\swsetup\SP34489A\wdrvinst.cmd
C:\swsetup\SP34746\BT.vbs
C:\swsetup\SP34746\Comp.ini
C:\swsetup\SP34746\msvbvm60.dll
C:\swsetup\SP34746\RStone.exe
C:\swsetup\SP34746\RStone.ini
C:\swsetup\SP34746\Setup.cmd
C:\swsetup\SP34746\SP34746.CVA
C:\swsetup\SP34746\WCAMC\CAMERA.CVA
C:\swsetup\SP34746\WCAMC\FW_210_Silence Install .exe
C:\swsetup\SP34746\WCAMC\Setup.exe
C:\swsetup\SP34746\WCAMR\DIFxAPI\amd64\DIFxAPI.dll
C:\swsetup\SP34746\WCAMR\DIFxAPI\x86\DIFxAPI.dll
C:\swsetup\SP34746\WCAMR\DPInst.exe
C:\swsetup\SP34746\WCAMR\DPInst64.exe
C:\swsetup\SP34746\WCAMR\driver\dpinst.xml
C:\swsetup\SP34746\WCAMR\driver\DPInst32.exe
C:\swsetup\SP34746\WCAMR\driver\DPInst64.exe
C:\swsetup\SP34746\WCAMR\driver\Install.bat
C:\swsetup\SP34746\WCAMR\driver\R5U870FL.inf
C:\swsetup\SP34746\WCAMR\driver\r5u870flamd64.cat
C:\swsetup\SP34746\WCAMR\driver\R5U870FLamd64.sys
C:\swsetup\SP34746\WCAMR\driver\r5u870flx86.cat
C:\swsetup\SP34746\WCAMR\driver\R5U870FLx86.sys
C:\swsetup\SP34746\WCAMR\driver\R5U870FUamd64.sys
C:\swsetup\SP34746\WCAMR\driver\R5U870FUx86.sys
C:\swsetup\SP34746\WCAMR\driver\RY5U870-SU002_32_64bit_Release.txt
C:\swsetup\SP34746\WCAMR\PID1810_001_UVC.SRM
C:\swsetup\SP34746\WCAMR\SROMwriter.exe
C:\swsetup\SP34746\WCAMR\SW32.exe
C:\swsetup\SP34746\WCAMR\SW32.ini
C:\swsetup\SP34746\WCAMR\SW64.exe
C:\swsetup\SP34746\WCAMR\SW64.ini
C:\swsetup\SP34746\WCAMR\Writer\SROMwtDrv.sys
C:\swsetup\SP34746\WCAMR\Writer\SROMwtDrv64.sys
C:\swsetup\SP34746\WCAMR\Writer\usb_vid_05ca_pid_1870.cat
C:\swsetup\SP34746\WCAMR\Writer\USB_Vid_05ca_Pid_1870.inf
C:\swsetup\SP35444\Setup.exe
C:\swsetup\SP35444\WinNT5\x86\data1.cab
C:\swsetup\SP35444\WinNT5\x86\data1.hdr
C:\swsetup\SP35444\WinNT5\x86\data2.cab
C:\swsetup\SP35444\WinNT5\x86\ikernel.ex_
C:\swsetup\SP35444\WinNT5\x86\InstNT.exe
C:\swsetup\SP35444\WinNT5\x86\layout.bin
C:\swsetup\SP35444\WinNT5\x86\setup.exe
C:\swsetup\SP35444\WinNT5\x86\setup.ini
C:\swsetup\SP35444\WinNT5\x86\setup.inx
C:\swsetup\SP35444\WinNT5\x86\setup.iss
C:\swsetup\SP35444\WinNT5\x86\SynCntxt.rtf
C:\swsetup\SP35444\WinNT5\x86\SynCOM.dll
C:\swsetup\SP35444\WinNT5\x86\SynCtrl.dll
C:\swsetup\SP35444\WinNT5\x86\synhid.inf
C:\swsetup\SP35444\WinNT5\x86\SynISDLL.dll
C:\swsetup\SP35444\WinNT5\x86\SynMood.exe
C:\swsetup\SP35444\WinNT5\x86\synpd.inf
C:\swsetup\SP35444\WinNT5\x86\syntp.cat
C:\swsetup\SP35444\WinNT5\x86\SynTP.sys
C:\swsetup\SP35444\WinNT5\x86\SynTPAPI.dll
C:\swsetup\SP35444\WinNT5\x86\SynTPCo4.dll
C:\swsetup\SP35444\WinNT5\x86\SynTPCOM.dll
C:\swsetup\SP35444\WinNT5\x86\SynTPCpl.dll
C:\swsetup\SP35444\WinNT5\x86\SynTPEnh.exe
C:\swsetup\SP35444\WinNT5\x86\SynTPRes.dll
C:\swsetup\SP35444\WinNT5\x86\SynUnst.ini
C:\swsetup\SP35444\WinNT5\x86\SynZMetr.exe
C:\swsetup\SP35444\WinNT5\x86\Tutorial.exe
C:\swsetup\SP35444\WinWDF\x64\dpinst.exe
C:\swsetup\SP35444\WinWDF\x64\dpinst.xml
C:\swsetup\SP35444\WinWDF\x64\InstNT.exe
C:\swsetup\SP35444\WinWDF\x64\setup.exe
C:\swsetup\SP35444\WinWDF\x64\SynCntxt.rtf
C:\swsetup\SP35444\WinWDF\x64\SynCOM.dll
C:\swsetup\SP35444\WinWDF\x64\SynCOM32.dll
C:\swsetup\SP35444\WinWDF\x64\SynCtrl.dll
C:\swsetup\SP35444\WinWDF\x64\SynCtrl32.dll
C:\swsetup\SP35444\WinWDF\x64\synhid.inf
C:\swsetup\SP35444\WinWDF\x64\SynISDLL.dll
C:\swsetup\SP35444\WinWDF\x64\SynLogo.ico
C:\swsetup\SP35444\WinWDF\x64\SynMood.exe
C:\swsetup\SP35444\WinWDF\x64\synpd.inf
C:\swsetup\SP35444\WinWDF\x64\SynTP.bmp
C:\swsetup\SP35444\WinWDF\x64\syntp.cat
C:\swsetup\SP35444\WinWDF\x64\SynTP.sys
C:\swsetup\SP35444\WinWDF\x64\SynTPAPI.dll
C:\swsetup\SP35444\WinWDF\x64\SynTPCo4.dll
C:\swsetup\SP35444\WinWDF\x64\SynTPCOM.dll
C:\swsetup\SP35444\WinWDF\x64\SynTPCOM32.dll
C:\swsetup\SP35444\WinWDF\x64\SynTPCpl.dll
C:\swsetup\SP35444\WinWDF\x64\SynTPEnh.exe
C:\swsetup\SP35444\WinWDF\x64\SynTPRes.dll
C:\swsetup\SP35444\WinWDF\x64\SynUnst.ini
C:\swsetup\SP35444\WinWDF\x64\SynZMetr.exe
C:\swsetup\SP35444\WinWDF\x64\Tutorial.exe
C:\swsetup\SP35444\WinWDF\x64\WdfCoInstaller01000.dll
C:\swsetup\SP35444\WinWDF\x86\dpinst.exe
C:\swsetup\SP35444\WinWDF\x86\dpinst.xml
C:\swsetup\SP35444\WinWDF\x86\InstNT.exe
C:\swsetup\SP35444\WinWDF\x86\setup.exe
C:\swsetup\SP35444\WinWDF\x86\SynCntxt.rtf
C:\swsetup\SP35444\WinWDF\x86\SynCOM.dll
C:\swsetup\SP35444\WinWDF\x86\SynCtrl.dll
C:\swsetup\SP35444\WinWDF\x86\synhid.inf
C:\swsetup\SP35444\WinWDF\x86\SynISDLL.dll
C:\swsetup\SP35444\WinWDF\x86\SynLogo.ico
C:\swsetup\SP35444\WinWDF\x86\SynMood.exe
C:\swsetup\SP35444\WinWDF\x86\synpd.inf
C:\swsetup\SP35444\WinWDF\x86\SynTP.bmp
C:\swsetup\SP35444\WinWDF\x86\syntp.cat
C:\swsetup\SP35444\WinWDF\x86\SynTP.sys
C:\swsetup\SP35444\WinWDF\x86\SynTPAPI.dll
C:\swsetup\SP35444\WinWDF\x86\SynTPCo4.dll
C:\swsetup\SP35444\WinWDF\x86\SynTPCOM.dll
C:\swsetup\SP35444\WinWDF\x86\SynTPCpl.dll
C:\swsetup\SP35444\WinWDF\x86\SynTPEnh.exe
C:\swsetup\SP35444\WinWDF\x86\SynTPRes.dll
C:\swsetup\SP35444\WinWDF\x86\SynUnst.ini
C:\swsetup\SP35444\WinWDF\x86\SynZMetr.exe
C:\swsetup\SP35444\WinWDF\x86\Tutorial.exe
C:\swsetup\SP35444\WinWDF\x86\WdfCoInstaller01000.dll
C:\WINDOWS\system32\5fc8.sentinel
C:\WINDOWS\system32\tmp19E.tmp
C:\WINDOWS\system32\tmp19F.tmp
C:\WINDOWS\system32\tmp1BA.tmp
C:\WINDOWS\system32\tmp1BB.tmp
C:\WINDOWS\system32\tmp400.tmp
C:\WINDOWS\system32\tmp401.tmp
C:\WINDOWS\Wincfg22c.drt

.
((((((((((((((((((((((((( Files Created from 2008-01-19 to 2008-02-19 )))))))))))))))))))))))))))))))
.

2008-02-14 23:29 . 2008-02-14 23:29 <DIR> d-------- C:\Program Files\GameShadow
2008-02-14 23:11 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
2008-02-14 23:11 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2008-02-14 23:11 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2008-02-14 23:11 . 2007-07-20 00:57 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll
2008-02-14 22:56 . 2008-02-14 22:56 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-14 22:56 . 2008-02-14 22:56 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-14 13:17 . 2008-02-14 13:17 <DIR> d-------- C:\Program Files\OpenAL
2008-02-14 13:17 . 2008-02-14 23:11 418,480 --a------ C:\WINDOWS\system32\wrap_oal.dll
2008-02-14 13:17 . 2008-02-14 23:11 115,432 --a------ C:\WINDOWS\system32\OpenAL32.dll
2008-02-10 15:16 . 2008-02-10 15:16 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-02-10 15:16 . 2008-02-10 15:16 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-02-08 00:58 . 2008-02-08 00:58 57 --a------ C:\WINDOWS\wininit.ini
2008-02-07 12:42 . 2008-02-07 12:42 1,905 --a------ C:\WINDOWS\diagwrn.xml
2008-02-07 12:42 . 2008-02-07 12:42 1,905 --a------ C:\WINDOWS\diagerr.xml
2008-02-04 12:11 . 2008-02-04 12:11 <DIR> d-------- C:\Documents and Settings\ZbiGG\Dane aplikacji\DP_Technology
2008-02-04 11:31 . 2008-02-04 11:31 <DIR> d-------- C:\Documents and Settings\ZbiGG\Dane aplikacji\DP Technology
2008-02-01 19:49 . 2008-02-01 19:49 24 --a------ C:\WINDOWS\system32\sysdate.ini
2008-02-01 13:23 . 2008-02-01 13:23 0 --a------ C:\WINDOWS\license.INI
2008-02-01 13:10 . 2008-02-08 01:07 <DIR> d-------- C:\Program Files\D.P.Technology
2008-02-01 13:07 . 2008-02-01 13:07 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-02-01 13:07 . 2008-02-01 13:07 <DIR> d-------- C:\Program Files\Common Files\SafeNet Sentinel
2008-01-29 14:40 . 2008-01-29 14:40 <DIR> d-------- C:\Program Files\JLC's Software
2008-01-29 14:40 . 2008-01-29 14:40 <DIR> d-------- C:\Documents and Settings\ZbiGG\Dane aplikacji\JLC's Software
2008-01-28 21:03 . 2008-01-28 21:03 <DIR> d-------- C:\Program Files\Alcohol Soft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-19 18:56 1,078,816 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-02-19 18:55 90,685,984 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-02-19 14:06 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-02-19 11:55 --------- d-----w C:\Program Files\DC++
2008-02-19 00:10 108,824 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-02-19 00:10 1,219,580 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-02-16 08:15 --------- d-----w C:\Documents and Settings\ZbiGG\Dane aplikacji\uTorrent
2008-02-14 22:31 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-02-10 14:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-08 00:12 --------- d-----w C:\Program Files\Valve
2008-02-03 19:39 --------- d-----w C:\Program Files\Winamp
2008-02-02 23:22 --------- d-----w C:\Documents and Settings\ZbiGG\Dane aplikacji\Skype
2008-02-02 11:22 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-02-01 13:49 --------- d-----w C:\Program Files\eMule
2008-01-31 16:53 91,700 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-01-21 09:42 --------- d-----w C:\Program Files\Gadu-Gadu
2008-01-16 21:59 --------- d-----w C:\Documents and Settings\ZbiGG\Dane aplikacji\MechSoft
2008-01-08 16:06 --------- d-----w C:\Program Files\LightScribeTemplateLabeler
2008-01-08 16:04 --------- d-----w C:\Documents and Settings\ZbiGG\Dane aplikacji\???????sAppData
2008-01-08 15:51 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\LightScribe
2008-01-08 15:50 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-01-06 21:55 --------- d-----w C:\Program Files\Windows Defender
2007-12-07 02:14 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:42 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-11-23 00:09 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-11-19 13:54 111,104 ----a-w C:\WINDOWS\system32\uha.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 21:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2007-01-29 22:02 200768]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-08-23 23:15 8478720]
"nwiz"="nwiz.exe" [2007-08-23 23:15 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-08-23 23:15 81920]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 13:36 827392]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-11-06 09:58 159744]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 19:29 39264]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Przyspieszenie uruchomienia programu AutoCAD.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Przyspieszenie uruchomienia programu AutoCAD.lnk
backup=C:\WINDOWS\pss\Przyspieszenie uruchomienia programu AutoCAD.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Service Manager.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Service Manager.lnk
backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva]
C:\WINDOWS\system32\amvo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\au]
C:\Program Files\Dealio\DealioAU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-06-27 18:03 152872 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--a------ 2006-07-26 21:44 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-12-05 12:30 2295072 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Media Codec Update Service]
--a------ 2007-04-08 17:44 303104 C:\Program Files\Essentials Codec Pack\update.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
--a------ 2007-10-23 01:47 360448 C:\Program Files\Winamp Remote\bin\OrbTray.exe

R3 R5U870FLx86;R5U870 UVC Lower Filter ;C:\WINDOWS\system32\Drivers\R5U870FLx86.sys [2006-10-18 00:09]
R3 R5U870FUx86;R5U870 UVC Upper Filter ;C:\WINDOWS\system32\Drivers\R5U870FUx86.sys [2006-10-18 00:09]
S2 SentinelFilter;SentinelFilter;F:\MAGNiTUDE\SENTINELFILTER.SYS []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{08edb7af-68f6-11dc-8d7a-001636fd3c1d}]
\Shell\AutoRun\command - G:\m.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{18d2d33c-aa68-11dc-886b-001636fd3c1d}]
\Shell\AutoRun\command - G:\h.cmd
\Shell\explore\Command - G:\h.cmd
\Shell\open\Command - G:\h.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{292a62f9-70c5-11dc-bfb5-001636fd3c1d}]
\Shell\AutoRun\command - H:\USBNB.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a86b377-62a0-11dc-8d6c-001636fd3c1d}]
\Shell\AutoRun\command - G:\3wcxx91.cmd
\Shell\explore\Command - G:\3wcxx91.cmd
\Shell\open\Command - G:\3wcxx91.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{48684d6f-5cb3-11dc-8d4d-001636fd3c1d}]
\Shell\AutoRun\command - I:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6688b9fa-d1a3-11dc-be2f-001636fd3c1d}]
\Shell\AutoRun\command - G:\ie.exe
\Shell\explore\Command - G:\ie.exe
\Shell\open\Command - G:\ie.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{77d4cbf9-c9b6-11dc-be22-001636fd3c1d}]
\Shell\Auto\command - activexdebugger32.exe f
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
\Shell\explore\Command - activexdebugger32.exe f
\Shell\open\Command - activexdebugger32.exe f

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a6cd033e-9100-11dc-bff6-001636fd3c1d}]
\Shell\Auto\command - H:\activexdebugger32.exe f
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
\Shell\explore\Command - H:\activexdebugger32.exe f
\Shell\open\Command - H:\activexdebugger32.exe f

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a80b645a-a119-11dc-8863-001636fd3c1d}]
\Shell\AutoRun\command - Z:\0hct8ybw.bat
\Shell\explore\Command - Z:\0hct8ybw.bat
\Shell\open\Command - Z:\0hct8ybw.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c63ac7c1-c01e-11dc-8889-001636fd3c1d}]
\Shell\AutoRun\command - G:\ie.exe
\Shell\explore\Command - G:\ie.exe
\Shell\open\Command - G:\ie.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd8665fa-80db-11dc-bfdd-001636fd3c1d}]
\Shell\AutoRun\command - F:\juok3st.bat
\Shell\explore\Command - F:\juok3st.bat
\Shell\open\Command - F:\juok3st.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff481055-5cae-11dc-8d49-bc6517e5f3fc}]
\Shell\AutoRun\command - G:\xo8wr9.exe
\Shell\explore\Command - G:\xo8wr9.exe
\Shell\open\Command - G:\xo8wr9.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
"2008-02-19 14:09:44 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-19 19:56:25
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-19 19:56:56
ComboFix-quarantined-files.txt 2008-02-19 18:56:54
ComboFix2.txt 2008-02-18 16:33:20
.
2008-02-15 06:48:36 --- E O F ---

[/b][/b]
ZbiGG
ZbiGG
Forumowicz
Forumowicz
 
Posty: 10
Dołączenie: 18 Lut 2008, 18:37
Miejscowość: Poznań

Postprzez pp3088 » 19 Lut 2008, 21:19

PostUA:


Wklej do Notatnika:
Registry::
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{08edb7af-68f6-11dc-8d7a-001636fd3c1d}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{18d2d33c-aa68-11dc-886b-001636fd3c1d}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{292a62f9-70c5-11dc-bfb5-001636fd3c1d}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a86b377-62a0-11dc-8d6c-001636fd3c1d}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{48684d6f-5cb3-11dc-8d4d-001636fd3c1d}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6688b9fa-d1a3-11dc-be2f-001636fd3c1d}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{77d4cbf9-c9b6-11dc-be22-001636fd3c1d}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a6cd033e-9100-11dc-bff6-001636fd3c1d}] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a80b645a-a119-11dc-8863-001636fd3c1d}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c63ac7c1-c01e-11dc-8889-001636fd3c1d}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd8665fa-80db-11dc-bfdd-001636fd3c1d}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff481055-5cae-11dc-8d49-bc6517e5f3fc}]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]



>>Plik>>Zapisz jako... >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe)
– podobnie jak na tym obrazku -->Image
(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)
Po restarcie usuń ręcznie folder C: \Qoobox.
Po tym nowy log z Combofix.
Awatar użytkownika
pp3088
Aktywny w piśmie
Aktywny w piśmie
 
Posty: 999
Dołączenie: 11 Sie 2006, 23:59
Miejscowość: Szczecin

Postprzez ZbiGG » 19 Lut 2008, 22:27

PostUA:


ok i kolejny log



ComboFix 08-02-18.1 - ZbiGG 2008-02-19 21:18:16.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.599 [GMT 1:00]
Running from: C:\Documents and Settings\ZbiGG\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\ZbiGG\Pulpit\CFScript.txt
* Created a new restore point

[b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((( Files Created from 2008-01-19 to 2008-02-19 )))))))))))))))))))))))))))))))
.

2008-02-14 23:29 . 2008-02-14 23:29 <DIR> d-------- C:\Program Files\GameShadow
2008-02-14 23:11 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
2008-02-14 23:11 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2008-02-14 23:11 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2008-02-14 23:11 . 2007-07-20 00:57 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll
2008-02-14 22:56 . 2008-02-14 22:56 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-14 22:56 . 2008-02-14 22:56 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-14 13:17 . 2008-02-14 13:17 <DIR> d-------- C:\Program Files\OpenAL
2008-02-14 13:17 . 2008-02-14 23:11 418,480 --a------ C:\WINDOWS\system32\wrap_oal.dll
2008-02-14 13:17 . 2008-02-14 23:11 115,432 --a------ C:\WINDOWS\system32\OpenAL32.dll
2008-02-10 15:16 . 2008-02-10 15:16 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-02-10 15:16 . 2008-02-10 15:16 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-02-08 00:58 . 2008-02-08 00:58 57 --a------ C:\WINDOWS\wininit.ini
2008-02-07 12:42 . 2008-02-07 12:42 1,905 --a------ C:\WINDOWS\diagwrn.xml
2008-02-07 12:42 . 2008-02-07 12:42 1,905 --a------ C:\WINDOWS\diagerr.xml
2008-02-04 12:11 . 2008-02-04 12:11 <DIR> d-------- C:\Documents and Settings\ZbiGG\Dane aplikacji\DP_Technology
2008-02-04 11:31 . 2008-02-04 11:31 <DIR> d-------- C:\Documents and Settings\ZbiGG\Dane aplikacji\DP Technology
2008-02-01 19:49 . 2008-02-01 19:49 24 --a------ C:\WINDOWS\system32\sysdate.ini
2008-02-01 13:23 . 2008-02-01 13:23 0 --a------ C:\WINDOWS\license.INI
2008-02-01 13:10 . 2008-02-08 01:07 <DIR> d-------- C:\Program Files\D.P.Technology
2008-02-01 13:07 . 2008-02-01 13:07 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-02-01 13:07 . 2008-02-01 13:07 <DIR> d-------- C:\Program Files\Common Files\SafeNet Sentinel
2008-01-29 14:40 . 2008-01-29 14:40 <DIR> d-------- C:\Program Files\JLC's Software
2008-01-29 14:40 . 2008-01-29 14:40 <DIR> d-------- C:\Documents and Settings\ZbiGG\Dane aplikacji\JLC's Software
2008-01-28 21:03 . 2008-01-28 21:03 <DIR> d-------- C:\Program Files\Alcohol Soft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-19 20:20 90,791,712 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-02-19 20:20 1,082,144 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-02-19 19:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-02-19 18:58 109,544 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-02-19 18:58 1,224,116 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-02-19 11:55 --------- d-----w C:\Program Files\DC++
2008-02-16 08:15 --------- d-----w C:\Documents and Settings\ZbiGG\Dane aplikacji\uTorrent
2008-02-14 22:31 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-02-10 14:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-08 00:12 --------- d-----w C:\Program Files\Valve
2008-02-03 19:39 --------- d-----w C:\Program Files\Winamp
2008-02-02 23:22 --------- d-----w C:\Documents and Settings\ZbiGG\Dane aplikacji\Skype
2008-02-02 11:22 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-02-01 13:49 --------- d-----w C:\Program Files\eMule
2008-01-31 16:53 91,700 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-01-21 09:42 --------- d-----w C:\Program Files\Gadu-Gadu
2008-01-16 21:59 --------- d-----w C:\Documents and Settings\ZbiGG\Dane aplikacji\MechSoft
2008-01-08 16:06 --------- d-----w C:\Program Files\LightScribeTemplateLabeler
2008-01-08 16:04 --------- d-----w C:\Documents and Settings\ZbiGG\Dane aplikacji\???????sAppData
2008-01-08 15:51 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\LightScribe
2008-01-08 15:50 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-01-06 21:55 --------- d-----w C:\Program Files\Windows Defender
2007-12-07 02:14 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:42 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-11-23 00:09 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-11-19 13:54 111,104 ----a-w C:\WINDOWS\system32\uha.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 21:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2007-01-29 22:02 200768]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-08-23 23:15 8478720]
"nwiz"="nwiz.exe" [2007-08-23 23:15 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-08-23 23:15 81920]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 13:36 827392]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-11-06 09:58 159744]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 19:29 39264]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Przyspieszenie uruchomienia programu AutoCAD.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Przyspieszenie uruchomienia programu AutoCAD.lnk
backup=C:\WINDOWS\pss\Przyspieszenie uruchomienia programu AutoCAD.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Service Manager.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Service Manager.lnk
backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva]
C:\WINDOWS\system32\amvo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\au]
C:\Program Files\Dealio\DealioAU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-06-27 18:03 152872 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--a------ 2006-07-26 21:44 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-12-05 12:30 2295072 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Media Codec Update Service]
--a------ 2007-04-08 17:44 303104 C:\Program Files\Essentials Codec Pack\update.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
--a------ 2007-10-23 01:47 360448 C:\Program Files\Winamp Remote\bin\OrbTray.exe

R3 R5U870FLx86;R5U870 UVC Lower Filter ;C:\WINDOWS\system32\Drivers\R5U870FLx86.sys [2006-10-18 00:09]
R3 R5U870FUx86;R5U870 UVC Upper Filter ;C:\WINDOWS\system32\Drivers\R5U870FUx86.sys [2006-10-18 00:09]
S2 SentinelFilter;SentinelFilter;F:\MAGNiTUDE\SENTINELFILTER.SYS []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{08edb7af-68f6-11dc-8d7a-001636fd3c1d}]
\Shell\AutoRun\command - G:\m.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{18d2d33c-aa68-11dc-886b-001636fd3c1d}]
\Shell\AutoRun\command - G:\h.cmd
\Shell\explore\Command - G:\h.cmd
\Shell\open\Command - G:\h.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{292a62f9-70c5-11dc-bfb5-001636fd3c1d}]
\Shell\AutoRun\command - H:\USBNB.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a86b377-62a0-11dc-8d6c-001636fd3c1d}]
\Shell\AutoRun\command - G:\3wcxx91.cmd
\Shell\explore\Command - G:\3wcxx91.cmd
\Shell\open\Command - G:\3wcxx91.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{48684d6f-5cb3-11dc-8d4d-001636fd3c1d}]
\Shell\AutoRun\command - I:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6688b9fa-d1a3-11dc-be2f-001636fd3c1d}]
\Shell\AutoRun\command - G:\ie.exe
\Shell\explore\Command - G:\ie.exe
\Shell\open\Command - G:\ie.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{77d4cbf9-c9b6-11dc-be22-001636fd3c1d}]
\Shell\Auto\command - activexdebugger32.exe f
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
\Shell\explore\Command - activexdebugger32.exe f
\Shell\open\Command - activexdebugger32.exe f

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a6cd033e-9100-11dc-bff6-001636fd3c1d}]
\Shell\Auto\command - H:\activexdebugger32.exe f
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe f
\Shell\explore\Command - H:\activexdebugger32.exe f
\Shell\open\Command - H:\activexdebugger32.exe f

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a80b645a-a119-11dc-8863-001636fd3c1d}]
\Shell\AutoRun\command - Z:\0hct8ybw.bat
\Shell\explore\Command - Z:\0hct8ybw.bat
\Shell\open\Command - Z:\0hct8ybw.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c63ac7c1-c01e-11dc-8889-001636fd3c1d}]
\Shell\AutoRun\command - G:\ie.exe
\Shell\explore\Command - G:\ie.exe
\Shell\open\Command - G:\ie.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd8665fa-80db-11dc-bfdd-001636fd3c1d}]
\Shell\AutoRun\command - F:\juok3st.bat
\Shell\explore\Command - F:\juok3st.bat
\Shell\open\Command - F:\juok3st.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff481055-5cae-11dc-8d49-bc6517e5f3fc}]
\Shell\AutoRun\command - G:\xo8wr9.exe
\Shell\explore\Command - G:\xo8wr9.exe
\Shell\open\Command - G:\xo8wr9.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
"2008-02-19 19:02:56 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-19 21:20:45
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-19 21:21:17
ComboFix2.txt 2008-02-19 18:56:57
.
2008-02-15 06:48:36 --- E O F ---


[/b]
ZbiGG
ZbiGG
Forumowicz
Forumowicz
 
Posty: 10
Dołączenie: 18 Lut 2008, 18:37
Miejscowość: Poznań

Postprzez pp3088 » 19 Lut 2008, 23:21

PostUA:


http://cybertrash.pl/images/tata/ATF/ATF.html

http://www.atribune.org/content/view/24/2/

Sprawdź. Zrób skan antywirusem i powiedz czy problem występuje nadal.
Awatar użytkownika
pp3088
Aktywny w piśmie
Aktywny w piśmie
 
Posty: 999
Dołączenie: 11 Sie 2006, 23:59
Miejscowość: Szczecin

Postprzez ZbiGG » 20 Lut 2008, 01:02

PostUA:


VunduFix nic nie znalazl
Atf-cleaner swoje wyczyścił
kasperski znalazł mi jeszcze 2 syfy a mianowicie:

usunięto: Koń trojański Trojan-Downloader.JS.Remora.bp Plik: C:\Program Files\Opera\profile\cache4\opr08GYW.htm

usunięto: wirus Worm.Win32.AutoRun.cmc Plik: D:\0hct8ybw.bat

pare restartów i wszystko wydaje się OK.

Dziekuje za pomoc!!!! POZDRAWIAM
ZbiGG
ZbiGG
Forumowicz
Forumowicz
 
Posty: 10
Dołączenie: 18 Lut 2008, 18:37
Miejscowość: Poznań


Powróć do Bezpieczeństwo

Kto jest na forum

Zarejestrowani użytkownicy: Brak zarejestrowanych użytkowników