Plik odzyskano z - Kitty ate it
.
((((((((((((((((((((((((( Pliki utworzone od 2009-10-19 do 2009-11-19 )))))))))))))))))))))))))))))))
.
2009-11-19 18:57 . 2009-11-19 18:57 34816 ----a-w- c:\windows\system32\oledsp32.dll
2009-11-19 18:39 . 2009-11-19 18:34 15880 ----a-w- c:\windows\system32\lsdelete.exe
2009-11-19 18:38 . 2009-11-19 18:38 -------- d-----w- c:\documents and settings\LocalService\Pulpit
2009-11-19 18:35 . 2009-09-23 12:55 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-11-19 18:35 . 2009-11-19 18:35 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2009-11-19 18:35 . 2009-11-19 18:35 93360 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\Drivers\SBREDrv.sys
2009-11-19 18:34 . 2009-11-19 18:35 862040 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\threatwork.exe
2009-11-19 18:34 . 2009-11-19 18:34 554280 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\sbap.dll
2009-11-19 18:34 . 2009-11-19 18:34 15880 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\lsdelete.exe
2009-11-19 18:34 . 2009-11-19 18:34 206944 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\lavamessage.dll
2009-11-19 18:34 . 2009-11-19 18:34 390288 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\lavalicense.dll
2009-11-19 18:34 . 2009-11-19 18:34 537576 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\aawapi.dll
2009-11-19 18:34 . 2009-11-19 18:34 212480 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\VipreBridge.dll
2009-11-19 18:34 . 2009-11-19 18:34 283944 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\Vipre.dll
2009-11-19 18:33 . 2009-11-19 18:34 370744 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2009-11-19 18:33 . 2009-11-19 18:33 163728 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\ShellExt.dll
2009-11-19 18:33 . 2009-11-19 18:33 194104 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\Savapibridge.dll
2009-11-19 18:33 . 2009-11-19 18:33 1223976 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\SBTE.dll
2009-11-19 18:33 . 2009-11-19 18:33 242984 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\SBRE.dll
2009-11-19 18:29 . 2009-11-19 18:29 5908024 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\Resources.dll
2009-11-19 18:29 . 2009-11-19 18:29 327000 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-11-19 18:29 . 2009-11-19 18:29 87496 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2009-11-19 18:29 . 2009-11-19 18:29 933120 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\CEAPI.dll
2009-11-19 18:29 . 2009-11-19 18:29 641632 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2009-11-19 18:27 . 2009-11-19 18:27 816272 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2009-11-19 18:27 . 2009-11-19 18:27 822904 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2009-11-19 18:27 . 2009-11-19 18:27 1638640 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-11-19 18:27 . 2009-11-19 18:27 788880 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\AAWTray.exe
2009-11-19 18:27 . 2009-11-19 18:27 1184912 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft\Ad-Aware\Update\AAWService.exe
2009-11-19 18:22 . 2009-11-19 18:22 -------- dc-h--w- c:\documents and settings\All Users\Dane aplikacji\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-11-19 18:22 . 2009-10-03 08:15 2924848 -c--a-w- c:\documents and settings\All Users\Dane aplikacji\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe
2009-11-19 18:22 . 2009-11-19 18:22 -------- d-----w- c:\program files\Lavasoft
2009-11-19 18:22 . 2009-11-19 18:22 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft
2009-11-17 19:53 . 2009-11-17 19:53 -------- d-----w- c:\program files\AskBarDis
2009-11-17 19:15 . 2009-11-17 19:15 -------- d-----w- c:\program files\ZoneAlarmSB
2009-11-17 19:15 . 2009-11-19 16:06 -------- d-----w- c:\windows\system32\ZoneLabs
2009-11-17 19:15 . 2008-07-09 08:05 1086952 ----a-w- c:\windows\system32\zpeng24.dll
2009-11-16 14:53 . 2009-11-16 14:54 -------- d-----w- c:\documents and settings\mariusz\Dane aplikacji\Tibia
2009-11-16 13:55 . 2009-11-16 13:55 -------- d-----w- c:\documents and settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Winamp Toolbar
2009-11-16 13:54 . 2009-11-16 13:54 -------- d-----r- c:\documents and settings\NetworkService\Ulubione
2009-11-15 21:01 . 2009-11-15 21:01 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\MailFrontier
2009-11-15 21:00 . 2009-11-19 15:54 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2009-11-15 21:00 . 2004-04-27 03:40 11264 ----a-w- c:\windows\system32\SpOrder.dll
2009-11-15 21:00 . 2009-11-19 16:06 -------- d-----w- c:\windows\Internet Logs
2009-11-07 18:54 . 2009-11-07 18:54 -------- d-----w- c:\documents and settings\mariusz\Ustawienia lokalne\Dane aplikacji\Winamp Toolbar
2009-11-07 18:20 . 2009-11-08 13:00 -------- d-----w- c:\documents and settings\mariusz\Dane aplikacji\ipla
2009-11-07 18:20 . 2009-11-07 18:20 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\ipla
2009-11-07 18:20 . 2009-11-07 18:20 348160 ----a-w- c:\windows\system32\Msvcr71.dll
2009-11-07 18:20 . 2009-11-07 18:20 1700352 ----a-w- c:\windows\system32\gdiplus.dll
2009-11-07 18:20 . 2009-11-07 18:20 1060864 ----a-w- c:\windows\system32\mfc71.dll
2009-11-03 19:52 . 2009-11-03 19:52 -------- d-----w- c:\documents and settings\mariusz\Ustawienia lokalne\Dane aplikacji\Ares
2009-10-31 19:53 . 2009-10-31 20:01 -------- d-----w- c:\documents and settings\mariusz\Dane aplikacji\Ventrilo
2009-10-30 07:35 . 2009-10-30 07:35 -------- d-----w- c:\documents and settings\wiola\Ustawienia lokalne\Dane aplikacji\Mozilla
2009-10-27 18:17 . 2009-10-27 18:17 -------- d-----w- c:\documents and settings\mariusz\Dane aplikacji\OpenFM
2009-10-27 15:08 . 2009-10-27 15:08 -------- d-----w- c:\documents and settings\mariusz\Dane aplikacji\teamspeak2
2009-10-27 14:50 . 2009-10-27 14:50 35840 --sh--w- c:\documents and settings\mariusz\ord32.dll
2009-10-27 11:48 . 2009-10-27 11:48 -------- d-----w- c:\program files\Winamp Toolbar
2009-10-27 11:48 . 2009-10-27 11:48 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar
2009-10-25 18:21 . 2009-10-25 18:21 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-10-25 18:21 . 2009-10-25 18:21 -------- d-----w- c:\documents and settings\mariusz\Dane aplikacji\skypePM
2009-10-25 18:17 . 2009-11-19 17:31 -------- d-----w- c:\documents and settings\mariusz\Dane aplikacji\Skype
2009-10-25 18:16 . 2009-10-25 18:16 -------- d-----w- c:\program files\Common Files\Skype
2009-10-25 18:16 . 2009-10-25 18:17 -------- d-----r- c:\program files\Skype
2009-10-25 18:16 . 2009-10-25 18:16 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Skype
2009-10-22 17:04 . 2001-08-17 18:19 96256 -c--a-w- c:\windows\system32\dllcache\ctlsb16.sys
2009-10-22 17:04 . 2001-08-17 18:19 96256 ----a-w- c:\windows\system32\drivers\ctlsb16.sys
2009-10-21 15:32 . 2004-04-30 07:37 160640 ----a-w- c:\windows\system32\drivers\a347bus.sys
2009-10-21 15:32 . 2004-04-30 07:33 5248 ----a-w- c:\windows\system32\drivers\a347scsi.sys
2009-10-21 15:32 . 2004-05-06 10:11 65024 ----a-w- c:\documents and settings\mariusz\trial_setup.exe
2009-10-21 15:32 . 2004-05-06 10:11 4289024 ----a-w- c:\documents and settings\mariusz\trial_setup.msi
2009-10-21 15:17 . 2009-10-21 15:17 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-10-21 15:04 . 2009-11-17 18:44 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-19 20:04 . 2009-10-19 15:51 736384 ----a-w- c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat
2009-11-17 18:44 . 2009-10-19 17:05 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-11-16 13:52 . 2009-10-20 13:30 14272 ----a-w- c:\documents and settings\wiola\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-11-15 14:27 . 2009-10-17 13:44 14272 ----a-w- c:\documents and settings\mariusz\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-11-03 18:21 . 2009-10-17 16:45 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab
2009-11-01 12:36 . 2009-10-27 11:47 -------- d-----w- c:\documents and settings\mariusz\Dane aplikacji\Winamp
2009-10-31 17:43 . 2009-10-19 17:58 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\OpenFM
2009-10-25 18:54 . 2009-10-19 19:24 -------- d-----w- c:\documents and settings\mariusz\Dane aplikacji\Nowe Gadu-Gadu
2009-10-25 12:09 . 2001-10-26 17:15 83880 ----a-w- c:\windows\system32\perfc015.dat
2009-10-25 12:09 . 2001-10-26 17:15 490628 ----a-w- c:\windows\system32\perfh015.dat
2009-10-20 13:30 . 2009-10-20 13:30 -------- d-----w- c:\documents and settings\wiola\Dane aplikacji\ATI
2009-10-19 16:55 . 2009-10-19 16:55 -------- d--h--r- c:\documents and settings\mariusz\Dane aplikacji\SecuROM
2009-10-19 16:41 . 2009-10-19 16:30 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2009-10-19 16:32 . 2009-10-19 16:32 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-10-19 15:56 . 2009-10-17 13:36 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-19 15:51 . 2009-10-19 15:51 -------- d-----w- c:\program files\MSBuild
2009-10-19 15:49 . 2009-10-19 15:49 -------- d-----w- c:\program files\Reference Assemblies
2009-10-19 15:32 . 2009-10-17 13:22 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-10-19 13:56 . 2009-10-19 13:56 0 ----a-w- c:\windows\nsreg.dat
2009-10-19 13:37 . 2009-10-17 13:46 15600 ----a-w- c:\windows\gdrv.sys
2009-10-18 19:45 . 2009-10-17 13:22 -------- d-----w- c:\program files\Usługi online
2009-10-18 14:08 . 2009-10-17 14:00 -------- d-----w- c:\program files\Realtek
2009-10-18 14:07 . 2009-10-18 14:07 -------- d-----w- c:\program files\Marvell
2009-10-17 16:45 . 2009-10-17 16:45 -------- d-----w- c:\program files\Kaspersky Lab
2009-10-17 16:37 . 2009-10-17 16:37 -------- d-----w- c:\program files\Yahoo!
2009-10-17 15:04 . 2009-10-17 15:04 8854 ----a-r- c:\documents and settings\mariusz\Dane aplikacji\Microsoft\Installer\{8FE4D086-63BD-44EB-882C-C7EA5A1EF016}\UNINST_Uninstall_Gam_8FE4D08663BD44EB882CC7EA5A1EF016.exe
2009-10-17 15:04 . 2009-10-17 15:04 65536 ----a-r- c:\documents and settings\mariusz\Dane aplikacji\Microsoft\Installer\{8FE4D086-63BD-44EB-882C-C7EA5A1EF016}\NewShortcut1_8FE4D08663BD44EB882CC7EA5A1EF016.exe
2009-10-17 15:04 . 2009-10-17 15:04 65536 ----a-r- c:\documents and settings\mariusz\Dane aplikacji\Microsoft\Installer\{8FE4D086-63BD-44EB-882C-C7EA5A1EF016}\HUD.exe_8FE4D08663BD44EB882CC7EA5A1EF016.exe
2009-10-17 15:04 . 2009-10-17 15:04 1150 ----a-r- c:\documents and settings\mariusz\Dane aplikacji\Microsoft\Installer\{8FE4D086-63BD-44EB-882C-C7EA5A1EF016}\ARPPRODUCTICON.exe
2009-10-17 15:04 . 2009-10-17 15:04 -------- d-----w- c:\program files\GIGABYTE
2009-10-17 14:00 . 2009-10-17 14:00 339968 ----a-w- c:\windows\HideWin.exe
2009-10-17 13:59 . 2009-10-17 13:59 -------- d-----w- c:\program files\DIFX
2009-10-17 13:44 . 2009-10-17 13:44 -------- d-----w- c:\documents and settings\mariusz\Dane aplikacji\ATI
2009-10-17 13:44 . 2009-10-17 13:44 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\ATI
2009-10-17 13:43 . 2009-10-17 13:43 0 ----a-w- c:\windows\ativpsrm.bin
2009-10-17 13:42 . 2009-10-17 13:36 -------- d-----w- c:\program files\ATI Technologies
2009-10-17 13:40 . 2009-10-17 13:36 -------- d-----w- c:\program files\Common Files\InstallShield
2009-10-17 13:39 . 2009-10-17 13:39 9158 ----a-r- c:\documents and settings\mariusz\Dane aplikacji\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
2009-10-17 13:39 . 2009-10-17 13:39 -------- d-----w- c:\program files\Common Files\ATI Technologies
2009-10-17 13:23 . 2009-10-17 13:23 -------- d-----w- c:\program files\microsoft frontpage
2009-10-17 13:20 . 2009-10-17 13:20 21856 ----a-w- c:\windows\system32\emptyregdb.dat
2008-04-14 20:50 . 2004-08-03 22:44 162155 --sha-r- c:\windows\system32\ikfbmcp.dll
.
------- Sigcheck -------
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\atapi.sys
[-] 2008-04-13 22:10 . !HASH: COULD NOT OPEN FILE !!!!! . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys
[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys
[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-11-19_17.19.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-29 07:05 . 2008-07-29 07:05 62976 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90rus.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05 46080 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90kor.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05 46592 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90jpn.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05 64512 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90ita.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05 66048 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90fra.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05 65024 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esp.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05 65024 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esn.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05 56832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90enu.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05 66560 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90deu.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05 39936 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90cht.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05 38912 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90chs.dll
+ 2008-07-29 05:07 . 2008-07-29 05:07 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90u.dll
+ 2008-07-29 05:07 . 2008-07-29 05:07 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90.dll
+ 2008-07-29 05:07 . 2008-07-29 05:07 80896 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfcm90ud.dll
+ 2008-07-29 05:07 . 2008-07-29 05:07 80896 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfcm90d.dll
+ 2009-11-19 18:35 . 2009-09-23 12:55 64288 c:\windows\system32\DRVSTORE\lbd_B425E86B28F27CC7F4A0CAF275F9F2789F3C6909\Lbd.sys
+ 2008-07-29 07:05 . 2008-07-29 07:05 875520 c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\msvcp90d.dll
+ 2008-07-29 02:54 . 2008-07-29 02:54 312832 c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\msvcm90d.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05 161784 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2\atl90.dll
+ 2009-11-19 18:21 . 2009-11-19 18:21 236032 c:\windows\Installer\2aff6a.msi
+ 2008-07-29 07:05 . 2008-07-29 07:05 3783672 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90u.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05 3768312 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05 5982720 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfc90ud.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05 5937144 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfc90d.dll
+ 2008-07-29 07:05 . 2008-07-29 07:05 1180672 c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\msvcr90d.dll
+ 2009-11-19 18:22 . 2009-11-19 18:22 1861120 c:\windows\Installer\2aff75.msi
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2009-05-06 1262888]
[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RGSC"="e:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe" [2009-10-19 306088]
"ares"="d:\program files\Ares\Ares.exe" [2008-12-13 906752]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-10-26 86016]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-07-05 16380416]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\mariusz\Menu Start\Programy\Autostart\
GIGABYTE Gamer HUD Lite.lnk - c:\program files\GIGABYTE\Gamer HUD Lite\HUD.exe [2008-10-14 1976832]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"e:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"e:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"d:\\Program Files\\Ares\\Ares.exe"=
"d:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"e:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Grupowanie sieci równorzędnej Windows
"3540:UDP"= 3540:UDP:Protokół rozpoznawania nazw równorzędnych (PNRP)
"1751:TCP"= 1751:TCP:xqetjask
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-11-19 64288]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2009-10-21 721904]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-09-24 1184912]
S2 pkvik;Config Task;c:\windows\system32\svchost.exe -k netsvcs [2004-08-03 14336]
S3 ctlsb16;Sterownik Creative SB16/AWE32/AWE64 (WDM);c:\windows\system32\drivers\ctlsb16.sys [2009-10-22 96256]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
pkvik
.
Zawartość folderu 'Zaplanowane zadania'
2009-11-19 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 18:27]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com
IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
FF - ProfilePath - c:\documents and settings\mariusz\Dane aplikacji\Mozilla\Firefox\Profiles\65s9rahg.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/sli ... ie7&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/sli ... pab&query=
FF - component: c:\documents and settings\mariusz\Dane aplikacji\Mozilla\Firefox\Profiles\65s9rahg.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
---- FIREFOX - SPOSÓB POSTĘPOWANIA ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-19 21:08
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8ADD01F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk
CLASSPNP.SYS @ 0xba0ecf28\Driver\ACPI
ACPI.sys @ 0xb9e3dcb8\Driver\atapi
0x8ab37420IoDeviceObjectType
DeleteProcedure ntkrnlpa.exe @ 0x805836a8ParseProcedure
ntkrnlpa.exe @ 0x805827e8\Device\Harddisk0\DR0
DeleteProcedure ntkrnlpa.exe @ 0x805836a8ParseProcedure
ntkrnlpa.exe @ 0x805827e8NDIS: NVIDIA nForce Networking Controller
SendCompleteHandler NDIS.sys @ 0xb9cc1bb0PacketIndicateHandler
NDIS.sys @ 0xb9ccea21SendHandler
NDIS.sys @ 0xb9cac87bWarning: possible MBR rootkit infection !
user & kernel MBR OK
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pkvik]
"ServiceDll"="c:\windows\system32\ikfbmcp.dll"
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_USERS\S-1-5-21-776561741-1715567821-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:81,21,36,f7,2f,57,96,77,33,61,ad,ea,1e,db,2a,f2,df,91,33,30,61,
de,2b,3e,5d,dc,76,f6,07,c5,b9,8c,f1,ca,bf,2f,12,9b,c1,f0,64,26,bf,15,22,15,\
"rkeysecu"=hex:5d,7c,7f,06,b2,19,11,4f,13,7d,87,43,75,df,0e,ea
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(832)
c:\windows\system32\Ati2evxx.dll
.
Czas ukończenia: 2009-11-19 21:08
ComboFix-quarantined-files.txt 2009-11-19 20:08
ComboFix2.txt 2009-11-19 17:38
ComboFix3.txt 2009-11-19 17:20
Przed: 892 530 688 bajtów wolnych
Po: 1 151 246 336 bajtów wolnych
- - End Of File - - 380386495B9F488E47A1841541F883AD
