Trojan.win32.agent

**Posty:** 19 · przez **jakisnick** 04 Wrz 2008, 14:39

Witam,

za żadne skarby nie mogę pozbyć się tego wirusa. Mam kaspersky 7.0, codziennie mi go wykrywa, usuwam go i nic to nie daje.

Oto log z hijack this:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:36:30, on 2008-09-04 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe D:\WINDOWS\system32\CTsvcCDA.exe D:\WINDOWS\system32\nvsvc32.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\RTHDCPL.EXE D:\WINDOWS\system32\RUNDLL32.EXE D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe D:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe D:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\Messenger\msmsgs.exe D:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe D:\Program Files\PopTray\PopTray.exe D:\Program Files\Common Files\Teleca Shared\Generic.exe D:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe D:\WINDOWS\system32\wuauclt.exe C:\Program Files\Gadu-Gadu\gg.exe D:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe D:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE D:\WINDOWS\explorer.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\Documents and Settings\user\Pulpit\ewido_micro.exe D:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://users.iptelecom.net.ua/~codecs/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - D:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Mario Forever Toolbar Helper - {8036D4D7-AAD3-4793-AB49-329E437155A8} - D:\Program Files\Mario Forever Toolbar\v2.0.0.3\Mario_Forever_Toolbar.dll (file missing) O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - D:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: Mario Forever Toolbar - {463DF6D5-BEC1-4d67-B217-59DB692DFC53} - D:\Program Files\Mario Forever Toolbar\v2.0.0.3\Mario_Forever_Toolbar.dll (file missing) O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [CafeNews] D:\Program Files\CafeNews\CN.exe /autostart O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "D:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [Samsung Common SM] "D:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: PopTray.lnk = D:\Program Files\PopTray\PopTray.exe O4 - Global Startup: DSLMON.lnk = D:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Pobierz za pomocą Mega Manager... - D:\Program Files\Megaupload\Mega Manager\mm_file.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{FE0E5779-21FE-464E-BA55-85BA08A66141}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - D:\Program Files\Ares\chatServer.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - D:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe -- End of file - 6626 bytes

Co mam zrobić, żeby się go pozbyć?
W ogóle znajduje mi go w folderze na D:/, którego w ogóle nie posiadam...

Pozdrawiam

**Posty:** 8001 · przez **Okocza** 04 Wrz 2008, 14:40

jakisnick, wstaw logi w odpowiednie tagi.

**Posty:** 684 · przez **djarta** 04 Wrz 2008, 16:56

02 - BHO: Mario Forever Toolbar Helper - {8036D4D7-AAD3-4793-AB49-329E437155A8} - D:\Program Files\Mario Forever Toolbar\v2.0.0.3\Mario_Forever_Toolbar.dll (file missing)
O3 - Toolbar: Mario Forever Toolbar - {463DF6D5-BEC1-4d67-B217-59DB692DFC53} - D:\Program Files\Mario Forever Toolbar\v2.0.0.3\Mario_Forever_Toolbar.dll (file missing)

Te w/w wpisy sfiksuj w Hijacku:
>>Hijack>>scan(Do a system scan only)>>zaznacz je >>Fix checked

Ściągnij -----> ComboFixa,przeskanuj daj log.

=========================================
K.

**Posty:** 19 · przez **jakisnick** 04 Wrz 2008, 18:58

Log z combofixa:

Kod: Zaznacz wszystko: ComboFix 08-09-03.06 - user 2008-09-04 18:52:43.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.594 [GMT 2:00] Running from: D:\Documents and Settings\user\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-08-04 to 2008-09-04 ))))))))))))))))))))))))))))))) . 2008-09-04 16:22 . 2008-09-04 16:22 <DIR> d-------- D:\WINDOWS\LastGood 2008-09-04 14:36 . 2008-09-04 14:36 <DIR> d-------- D:\Program Files\Trend Micro 2008-09-01 08:37 . 2008-09-04 06:19 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-09-01 08:37 . 2008-09-04 18:55 4,209,440 --ahs---- D:\WINDOWS\system32\drivers\fidbox.dat 2008-09-01 08:37 . 2008-09-01 08:55 96,976 --a------ D:\WINDOWS\system32\drivers\klin.dat 2008-09-01 08:37 . 2008-09-01 08:55 87,855 --a------ D:\WINDOWS\system32\drivers\klick.dat 2008-09-01 08:37 . 2008-09-03 22:01 48,212 --ahs---- D:\WINDOWS\system32\drivers\fidbox.idx 2008-09-01 08:37 . 2008-09-04 18:54 21,792 --ahs---- D:\WINDOWS\system32\drivers\fidbox2.dat 2008-09-01 08:37 . 2008-09-03 22:01 3,392 --ahs---- D:\WINDOWS\system32\drivers\fidbox2.idx 2008-08-31 21:37 . 2008-09-01 08:27 <DIR> d-------- D:\Program Files\Kaspersky Lab 2008-08-31 21:36 . 2008-09-01 08:09 <DIR> d-------- D:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-08-24 20:51 . 2008-08-25 06:21 54,156 --ah----- D:\WINDOWS\QTFont.qfn 2008-08-24 20:51 . 2008-08-24 20:51 1,409 --a------ D:\WINDOWS\QTFont.for 2008-08-15 19:59 . 2008-08-15 20:00 <DIR> d-------- D:\Program Files\XVideoConverter 2008-08-15 19:59 . 2008-08-15 20:05 <DIR> d-a------ D:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-08-07 22:28 . 2008-08-07 22:31 <DIR> d-------- D:\Program Files\AtomixMP3 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-01 06:55 112,144 ----a-w D:\WINDOWS\system32\drivers\kl1.sys 2008-08-29 12:13 --------- d-----w D:\Documents and Settings\user\Dane aplikacji\MegauploadToolbar 2008-08-24 14:01 --------- d-----w D:\Program Files\IDoser v4 2008-08-15 17:04 --------- d-----w D:\Program Files\NAPI-PROJEKT 2008-08-07 22:26 --------- d-----w D:\Documents and Settings\user\Dane aplikacji\Skype 2008-08-07 22:24 --------- d-----w D:\Documents and Settings\user\Dane aplikacji\skypePM 2008-07-18 20:10 94,920 ----a-w D:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w D:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:09 563,912 ----a-w D:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w D:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w D:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w D:\WINDOWS\system32\wuaueng.dll 2008-07-15 17:36 --------- d-----w D:\Program Files\MegauploadToolbar 2008-07-11 13:24 --------- d-----w D:\Program Files\Last.fm 2008-07-08 14:45 --------- d-----w D:\Program Files\Matura_testy_2007 2008-07-07 20:33 253,952 ----a-w D:\WINDOWS\system32\es.dll 2008-06-24 16:24 74,240 ----a-w D:\WINDOWS\system32\mscms.dll 2008-06-23 15:41 662,016 ----a-w D:\WINDOWS\system32\wininet.dll 2008-06-20 17:42 246,784 ----a-w D:\WINDOWS\system32\mswsock.dll 2007-11-23 13:17 32 ----a-w D:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2006-06-23 06:48 32,768 ----a-r D:\WINDOWS\inf\UpdateUSB.exe . ((((((((((((((((((((((((((((( snapshot@2008-05-01_10.49.12,28 ))))))))))))))))))))))))))))))))))))))))) . + 2008-01-23 04:56:21 554,008 ----a-w D:\WINDOWS\$hf_mig$\KB950749\SP2QFE\dao360.dll + 2007-12-10 12:41:11 518,944 ----a-w D:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msexch40.dll + 2007-12-10 12:41:11 326,432 ----a-w D:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msexcl40.dll + 2007-12-10 12:41:11 1,516,568 ----a-w D:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjet40.dll + 2007-12-10 12:41:11 355,112 ----a-w D:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjetol1.dll + 2007-11-01 05:16:26 178,976 ----a-w D:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjint40.dll + 2007-12-10 12:41:12 60,192 ----a-w D:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjter40.dll + 2007-12-10 12:41:12 248,608 ----a-w D:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjtes40.dll + 2007-12-10 12:41:12 219,936 ----a-w D:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msltus40.dll + 2007-12-10 12:41:12 355,104 ----a-w D:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mspbde40.dll + 2007-12-10 12:41:13 432,928 ----a-w D:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrd2x40.dll + 2007-12-10 12:41:13 322,336 ----a-w D:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrd3x40.dll + 2007-12-10 12:41:13 559,904 ----a-w D:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrepl40.dll + 2007-12-10 12:41:13 264,992 ----a-w D:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mstext40.dll + 2007-12-10 12:41:13 838,432 ----a-w D:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mswdat10.dll + 2007-11-01 05:16:27 621,344 ----a-w D:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mswstr10.dll + 2007-12-10 12:41:14 355,104 ----a-w D:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msxbde40.dll + 2007-03-06 03:28:35 16,096 ----a-w D:\WINDOWS\$hf_mig$\KB950749\spmsg.dll + 2007-03-06 03:28:40 216,288 ----a-w D:\WINDOWS\$hf_mig$\KB950749\spuninst.exe + 2007-03-06 03:28:33 22,752 ----a-w D:\WINDOWS\$hf_mig$\KB950749\update\spcustom.dll + 2007-03-06 03:28:58 723,680 ----a-w D:\WINDOWS\$hf_mig$\KB950749\update\update.exe + 2007-03-06 03:29:50 386,784 ----a-w D:\WINDOWS\$hf_mig$\KB950749\update\updspapi.dll + 2008-04-21 06:58:11 1,024,000 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\browseui.dll + 2008-04-21 06:58:11 151,552 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\cdfview.dll + 2008-04-21 06:58:12 1,055,744 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\danim.dll + 2008-04-21 06:58:12 357,888 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\dxtmsft.dll + 2008-04-21 06:58:13 205,312 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\dxtrans.dll + 2008-04-21 06:58:13 55,808 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\extmgr.dll + 2008-04-17 10:46:59 18,432 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\iedw.exe + 2008-04-21 06:58:13 251,904 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\iepeers.dll + 2008-04-21 06:58:13 96,768 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\inseng.dll + 2008-04-21 06:58:13 16,384 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\jsproxy.dll + 2008-04-21 06:58:17 3,087,872 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\mshtml.dll + 2008-04-21 06:58:18 449,024 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\mshtmled.dll + 2008-04-21 06:58:18 146,432 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\msrating.dll + 2008-04-21 06:58:18 532,480 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\mstime.dll + 2008-04-21 06:58:19 39,424 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\pngfilt.dll + 2008-04-21 06:58:20 1,499,136 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\shdocvw.dll + 2008-04-21 06:58:21 474,112 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\shlwapi.dll + 2008-04-17 11:03:57 369,152 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\spru0415.dll + 2008-04-21 06:58:22 619,520 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\urlmon.dll + 2008-04-21 06:58:22 669,184 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP2QFE\wininet.dll + 2008-04-21 06:44:32 3,087,872 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP3GDR\mshtml.dll + 2008-04-21 06:44:33 668,672 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP3GDR\wininet.dll + 2008-04-21 06:41:26 3,088,384 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP3QFE\mshtml.dll + 2008-04-21 06:41:27 669,184 ----a-w D:\WINDOWS\$hf_mig$\KB950759\SP3QFE\wininet.dll + 2007-11-30 12:40:46 19,320 ----a-w D:\WINDOWS\$hf_mig$\KB950759\spmsg.dll + 2007-11-30 12:40:46 234,360 ----a-w D:\WINDOWS\$hf_mig$\KB950759\spuninst.exe + 2007-11-30 12:40:46 26,488 ----a-w D:\WINDOWS\$hf_mig$\KB950759\update\spcustom.dll + 2007-11-30 12:40:47 763,256 ----a-w D:\WINDOWS\$hf_mig$\KB950759\update\update.exe + 2007-11-30 12:40:47 398,200 ----a-w D:\WINDOWS\$hf_mig$\KB950759\update\updspapi.dll + 2007-11-30 12:40:46 19,320 ----a-w D:\WINDOWS\$hf_mig$\KB950760\spmsg.dll + 2007-11-30 12:40:46 234,360 ----a-w D:\WINDOWS\$hf_mig$\KB950760\spuninst.exe + 2007-11-30 12:40:46 26,488 ----a-w D:\WINDOWS\$hf_mig$\KB950760\update\spcustom.dll + 2007-11-30 12:40:47 763,256 ----a-w D:\WINDOWS\$hf_mig$\KB950760\update\update.exe + 2007-11-30 12:40:47 398,200 ----a-w D:\WINDOWS\$hf_mig$\KB950760\update\updspapi.dll + 2008-05-08 12:14:51 203,008 ----a-w D:\WINDOWS\$hf_mig$\KB950762\SP2QFE\rmcast.sys + 2008-05-08 14:02:52 203,136 ----a-w D:\WINDOWS\$hf_mig$\KB950762\SP3GDR\rmcast.sys + 2008-05-08 13:58:17 203,136 ----a-w D:\WINDOWS\$hf_mig$\KB950762\SP3QFE\rmcast.sys + 2007-11-30 12:40:46 19,320 ----a-w D:\WINDOWS\$hf_mig$\KB950762\spmsg.dll + 2007-11-30 12:40:46 234,360 ----a-w D:\WINDOWS\$hf_mig$\KB950762\spuninst.exe + 2007-11-30 12:40:46 26,488 ----a-w D:\WINDOWS\$hf_mig$\KB950762\update\spcustom.dll + 2007-11-30 12:40:47 763,256 ----a-w D:\WINDOWS\$hf_mig$\KB950762\update\update.exe + 2007-11-30 12:40:47 398,200 ----a-w D:\WINDOWS\$hf_mig$\KB950762\update\updspapi.dll + 2008-06-14 18:06:01 273,024 ----a-w D:\WINDOWS\$hf_mig$\KB951376-v2\SP2QFE\bthport.sys + 2008-06-14 17:36:22 273,024 ----a-w D:\WINDOWS\$hf_mig$\KB951376-v2\SP3GDR\bthport.sys + 2008-06-14 17:41:01 273,024 ----a-w D:\WINDOWS\$hf_mig$\KB951376-v2\SP3QFE\bthport.sys + 2007-11-30 11:21:28 19,320 ----a-w D:\WINDOWS\$hf_mig$\KB951376-v2\spmsg.dll + 2007-11-30 11:21:28 234,360 ----a-w D:\WINDOWS\$hf_mig$\KB951376-v2\spuninst.exe + 2007-11-30 11:21:28 26,488 ----a-w D:\WINDOWS\$hf_mig$\KB951376-v2\update\spcustom.dll + 2007-11-30 11:21:28 763,256 ----a-w D:\WINDOWS\$hf_mig$\KB951376-v2\update\update.exe + 2007-11-30 11:21:29 398,200 ----a-w D:\WINDOWS\$hf_mig$\KB951376-v2\update\updspapi.dll + 2008-04-14 16:17:51 273,024 ----a-w D:\WINDOWS\$hf_mig$\KB951376\SP2QFE\bthport.sys + 2008-04-14 16:00:25 273,024 ----a-w D:\WINDOWS\$hf_mig$\KB951376\SP3GDR\bthport.sys + 2008-04-14 16:22:51 273,024 ----a-w D:\WINDOWS\$hf_mig$\KB951376\SP3QFE\bthport.sys + 2007-11-30 11:21:28 19,320 ----a-w D:\WINDOWS\$hf_mig$\KB951376\spmsg.dll + 2007-11-30 11:21:28 234,360 ----a-w D:\WINDOWS\$hf_mig$\KB951376\spuninst.exe + 2007-11-30 11:21:28 26,488 ----a-w D:\WINDOWS\$hf_mig$\KB951376\update\spcustom.dll + 2007-11-30 11:21:28 763,256 ----a-w D:\WINDOWS\$hf_mig$\KB951376\update\update.exe + 2007-11-30 11:21:29 398,200 ----a-w D:\WINDOWS\$hf_mig$\KB951376\update\updspapi.dll + 2008-05-07 05:03:16 1,291,776 ----a-w D:\WINDOWS\$hf_mig$\KB951698\SP2QFE\quartz.dll + 2008-05-07 05:12:18 1,291,776 ----a-w D:\WINDOWS\$hf_mig$\KB951698\SP3GDR\quartz.dll + 2008-05-07 05:09:08 1,291,776 ----a-w D:\WINDOWS\$hf_mig$\KB951698\SP3QFE\quartz.dll + 2007-11-30 11:21:28 19,320 ----a-w D:\WINDOWS\$hf_mig$\KB951698\spmsg.dll + 2007-11-30 11:21:28 234,360 ----a-w D:\WINDOWS\$hf_mig$\KB951698\spuninst.exe + 2007-11-30 11:21:28 26,488 ----a-w D:\WINDOWS\$hf_mig$\KB951698\update\spcustom.dll + 2007-11-30 12:40:47 763,256 ----a-w D:\WINDOWS\$hf_mig$\KB951698\update\update.exe + 2007-11-30 12:40:47 398,200 ----a-w D:\WINDOWS\$hf_mig$\KB951698\update\updspapi.dll + 2006-08-16 12:14:48 100,352 ----a-w D:\WINDOWS\$hf_mig$\KB951748\SP2QFE\6to4svc.dll + 2008-06-20 10:44:08 138,368 ----a-w D:\WINDOWS\$hf_mig$\KB951748\SP2QFE\afd.sys + 2008-06-20 17:37:41 147,968 ----a-w D:\WINDOWS\$hf_mig$\KB951748\SP2QFE\dnsapi.dll + 2008-06-20 17:37:41 246,784 ----a-w D:\WINDOWS\$hf_mig$\KB951748\SP2QFE\mswsock.dll + 2008-06-20 10:44:42 360,960 ----a-w D:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys + 2008-06-20 09:32:39 225,920 ----a-w D:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip6.sys + 2008-06-20 11:40:08 138,496 ----a-w D:\WINDOWS\$hf_mig$\KB951748\SP3GDR\afd.sys + 2008-06-20 17:48:53 147,968 ----a-w D:\WINDOWS\$hf_mig$\KB951748\SP3GDR\dnsapi.dll + 2008-06-20 17:48:53 246,784 ----a-w D:\WINDOWS\$hf_mig$\KB951748\SP3GDR\mswsock.dll + 2008-06-20 11:51:12 361,600 ----a-w D:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys + 2008-06-20 11:08:27 225,856 ----a-w D:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip6.sys + 2008-06-20 11:48:03 138,496 ----a-w D:\WINDOWS\$hf_mig$\KB951748\SP3QFE\afd.sys + 2008-06-20 17:44:44 147,968 ----a-w D:\WINDOWS\$hf_mig$\KB951748\SP3QFE\dnsapi.dll + 2008-06-20 17:44:44 246,784 ----a-w D:\WINDOWS\$hf_mig$\KB951748\SP3QFE\mswsock.dll + 2008-06-20 11:59:02 361,600 ----a-w D:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys + 2008-06-20 11:16:44 225,856 ----a-w D:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip6.sys + 2007-11-30 12:40:46 19,320 ----a-w D:\WINDOWS\$hf_mig$\KB951748\spmsg.dll + 2007-11-30 12:40:46 234,360 ----a-w D:\WINDOWS\$hf_mig$\KB951748\spuninst.exe + 2007-11-30 12:40:46 26,488 ----a-w D:\WINDOWS\$hf_mig$\KB951748\update\spcustom.dll + 2007-11-30 12:40:47 763,256 ----a-w D:\WINDOWS\$hf_mig$\KB951748\update\update.exe + 2007-11-30 12:40:48 398,200 ----a-w D:\WINDOWS\$hf_mig$\KB951748\update\updspapi.dll + 2004-08-03 22:43:56 561,179 -c----w D:\WINDOWS\$NtUninstallKB950749$\dao360.dll + 2004-08-03 22:44:04 512,029 -c----w D:\WINDOWS\$NtUninstallKB950749$\msexch40.dll + 2004-08-03 22:44:06 319,517 -c----w D:\WINDOWS\$NtUninstallKB950749$\msexcl40.dll + 2004-08-03 22:44:06 1,507,356 -c----w D:\WINDOWS\$NtUninstallKB950749$\msjet40.dll + 2004-07-17 09:34:48 358,976 -c----w D:\WINDOWS\$NtUninstallKB950749$\msjetol1.dll + 2004-07-17 09:34:48 358,976 -c----w D:\WINDOWS\$NtUninstallKB950749$\msjetoledb40.dll + 2004-08-03 22:44:06 172,063 -c----w D:\WINDOWS\$NtUninstallKB950749$\msjint40.dll + 2004-08-03 22:44:06 53,279 -c----w D:\WINDOWS\$NtUninstallKB950749$\msjter40.dll + 2004-08-03 22:44:06 241,693 -c----w D:\WINDOWS\$NtUninstallKB950749$\msjtes40.dll + 2004-08-03 22:44:06 213,023 -c----w D:\WINDOWS\$NtUninstallKB950749$\msltus40.dll + 2004-08-03 22:44:06 348,189 -c----w D:\WINDOWS\$NtUninstallKB950749$\mspbde40.dll + 2004-08-03 22:44:06 421,919 -c----w D:\WINDOWS\$NtUninstallKB950749$\msrd2x40.dll + 2004-08-03 22:44:06 315,423 -c----w D:\WINDOWS\$NtUninstallKB950749$\msrd3x40.dll + 2004-08-03 22:44:06 552,989 -c----w D:\WINDOWS\$NtUninstallKB950749$\msrepl40.dll + 2004-08-03 22:44:06 258,077 -c----w D:\WINDOWS\$NtUninstallKB950749$\mstext40.dll + 2004-08-03 22:44:06 831,519 -c----w D:\WINDOWS\$NtUninstallKB950749$\mswdat10.dll + 2004-08-03 22:44:06 614,429 -c----w D:\WINDOWS\$NtUninstallKB950749$\mswstr10.dll + 2004-08-03 22:44:06 348,189 -c----w D:\WINDOWS\$NtUninstallKB950749$\msxbde40.dll + 2007-03-06 03:28:40 216,288 -c----w D:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe + 2007-03-06 03:29:50 386,784 -c----w D:\WINDOWS\$NtUninstallKB950749$\spuninst\updspapi.dll + 2008-02-16 09:05:10 1,023,488 -c----w D:\WINDOWS\$NtUninstallKB950759$\browseui.dll + 2008-02-16 09:05:10 151,552 -c----w D:\WINDOWS\$NtUninstallKB950759$\cdfview.dll + 2008-02-16 09:05:11 1,055,744 -c----w D:\WINDOWS\$NtUninstallKB950759$\danim.dll + 2008-02-16 09:05:11 357,888 -c----w D:\WINDOWS\$NtUninstallKB950759$\dxtmsft.dll + 2008-02-16 09:05:11 205,312 -c----w D:\WINDOWS\$NtUninstallKB950759$\dxtrans.dll + 2008-02-16 09:05:11 55,808 -c----w D:\WINDOWS\$NtUninstallKB950759$\extmgr.dll + 2008-02-15 09:23:37 18,432 -c----w D:\WINDOWS\$NtUninstallKB950759$\iedw.exe + 2008-02-16 09:05:11 251,392 -c----w D:\WINDOWS\$NtUninstallKB950759$\iepeers.dll + 2008-02-16 09:05:11 96,768 -c----w D:\WINDOWS\$NtUninstallKB950759$\inseng.dll + 2008-02-16 09:05:11 16,384 -c----w D:\WINDOWS\$NtUninstallKB950759$\jsproxy.dll + 2008-02-16 22:35:14 3,080,704 -c----w D:\WINDOWS\$NtUninstallKB950759$\mshtml.dll + 2008-02-16 09:05:13 449,024 -c----w D:\WINDOWS\$NtUninstallKB950759$\mshtmled.dll + 2008-02-16 09:05:13 146,432 -c----w D:\WINDOWS\$NtUninstallKB950759$\msrating.dll + 2008-02-16 09:05:13 532,480 -c----w D:\WINDOWS\$NtUninstallKB950759$\mstime.dll + 2008-02-16 09:05:14 39,424 -c----w D:\WINDOWS\$NtUninstallKB950759$\pngfilt.dll + 2008-02-16 09:05:15 1,494,528 -c----w D:\WINDOWS\$NtUninstallKB950759$\shdocvw.dll + 2008-02-16 09:05:15 474,112 -c----w D:\WINDOWS\$NtUninstallKB950759$\shlwapi.dll + 2007-11-30 12:40:46 234,360 -c----w D:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe + 2007-11-30 12:40:47 398,200 -c----w D:\WINDOWS\$NtUninstallKB950759$\spuninst\updspapi.dll + 2008-02-16 09:05:15 616,960 -c----w D:\WINDOWS\$NtUninstallKB950759$\urlmon.dll + 2008-02-16 09:05:15 662,016 -c----w D:\WINDOWS\$NtUninstallKB950759$\wininet.dll + 2008-02-15 23:03:24 369,152 -c----w D:\WINDOWS\$NtUninstallKB950759$\xpsp3res.dll + 2007-11-30 12:40:46 234,360 -c----w D:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe + 2007-11-30 12:40:47 398,200 -c----w D:\WINDOWS\$NtUninstallKB950760$\spuninst\updspapi.dll + 2006-07-13 08:48:58 202,240 -c----w D:\WINDOWS\$NtUninstallKB950762$\rmcast.sys + 2007-11-30 12:40:46 234,360 -c----w D:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe + 2007-11-30 12:40:47 398,200 -c----w D:\WINDOWS\$NtUninstallKB950762$\spuninst\updspapi.dll + 2008-04-14 15:53:43 273,024 -c----w D:\WINDOWS\$NtUninstallKB951376-v2$\bthport.sys + 2007-11-30 11:21:28 234,360 -c----w D:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe + 2007-11-30 11:21:29 398,200 -c----w D:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\updspapi.dll + 2007-11-30 11:21:28 234,360 -c----w D:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe + 2007-11-30 11:21:29 398,200 -c----w D:\WINDOWS\$NtUninstallKB951376$\spuninst\updspapi.dll + 2007-10-29 22:44:30 1,291,264 -c----w D:\WINDOWS\$NtUninstallKB951698$\quartz.dll + 2007-11-30 11:21:28 234,360 -c----w D:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe + 2007-11-30 12:40:47 398,200 -c----w D:\WINDOWS\$NtUninstallKB951698$\spuninst\updspapi.dll + 2004-08-03 21:14:16 138,496 -c----w D:\WINDOWS\$NtUninstallKB951748$\afd.sys + 2008-02-20 05:38:07 148,992 -c----w D:\WINDOWS\$NtUninstallKB951748$\dnsapi.dll + 2004-08-03 22:44:06 246,784 -c----w D:\WINDOWS\$NtUninstallKB951748$\mswsock.dll + 2007-11-30 12:40:46 234,360 -c----w D:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe + 2007-11-30 12:40:48 398,200 -c----w D:\WINDOWS\$NtUninstallKB951748$\spuninst\updspapi.dll + 2007-10-30 17:20:55 360,064 -c----w D:\WINDOWS\$NtUninstallKB951748$\tcpip.sys + 2006-08-16 09:37:30 225,664 -c----w D:\WINDOWS\$NtUninstallKB951748$\tcpip6.sys + 2008-06-14 18:01:34 273,024 ------w D:\WINDOWS\Driver Cache\i386\bthport.sys - 2000-08-31 06:00:00 73,728 ----a-w D:\WINDOWS\fdsv.exe + 2000-08-31 06:00:00 89,504 ----a-w D:\WINDOWS\fdsv.exe + 2007-07-30 18:19:20 92,504 ----a-w D:\WINDOWS\LastGood\system32\cdm.dll + 2007-07-30 18:19:36 549,720 ----a-w D:\WINDOWS\LastGood\system32\wuapi.dll + 2007-07-30 18:19:16 53,080 ----a-w D:\WINDOWS\LastGood\system32\wuauclt.exe + 2007-07-30 18:19:42 1,712,984 ----a-w D:\WINDOWS\LastGood\system32\wuaueng.dll + 2007-07-30 18:19:32 325,976 ----a-w D:\WINDOWS\LastGood\system32\wucltui.dll + 2007-07-30 18:18:40 33,624 ----a-w D:\WINDOWS\LastGood\system32\wups.dll + 2007-07-30 18:19:12 43,352 ----a-w D:\WINDOWS\LastGood\system32\wups2.dll + 2007-07-30 18:19:28 203,096 ----a-w D:\WINDOWS\LastGood\system32\wuweb.dll - 2000-08-31 06:00:00 28,160 ----a-w D:\WINDOWS\Nircmd.exe + 2000-08-31 06:00:00 28,672 ----a-w D:\WINDOWS\Nircmd.exe - 2008-02-16 09:05:10 1,023,488 ----a-w D:\WINDOWS\system32\browseui.dll + 2008-06-23 15:41:35 1,023,488 ----a-w D:\WINDOWS\system32\browseui.dll - 2008-02-16 09:05:10 151,552 ----a-w D:\WINDOWS\system32\cdfview.dll + 2008-06-23 15:41:35 151,552 ----a-w D:\WINDOWS\system32\cdfview.dll - 2008-02-16 09:05:11 1,055,744 ----a-w D:\WINDOWS\system32\danim.dll + 2008-06-23 15:41:36 1,055,744 ----a-w D:\WINDOWS\system32\danim.dll - 2004-08-03 21:14:16 138,496 -c--a-w D:\WINDOWS\system32\dllcache\afd.sys + 2008-06-20 10:44:38 138,368 -c--a-w D:\WINDOWS\system32\dllcache\afd.sys - 2008-02-16 09:05:10 1,023,488 -c--a-w D:\WINDOWS\system32\dllcache\browseui.dll + 2008-06-23 15:41:35 1,023,488 -c--a-w D:\WINDOWS\system32\dllcache\browseui.dll + 2008-06-14 18:01:34 273,024 -c----w D:\WINDOWS\system32\dllcache\bthport.sys - 2008-02-16 09:05:10 151,552 -c--a-w D:\WINDOWS\system32\dllcache\cdfview.dll + 2008-06-23 15:41:35 151,552 -c--a-w D:\WINDOWS\system32\dllcache\cdfview.dll - 2007-07-30 18:19:20 92,504 -c--a-w D:\WINDOWS\system32\dllcache\cdm.dll + 2008-07-18 20:10:48 94,920 -c--a-w D:\WINDOWS\system32\dllcache\cdm.dll - 2008-02-16 09:05:11 1,055,744 -c--a-w D:\WINDOWS\system32\dllcache\danim.dll + 2008-06-23 15:41:36 1,055,744 -c--a-w D:\WINDOWS\system32\dllcache\danim.dll - 2004-08-03 22:43:56 561,179 -c--a-w D:\WINDOWS\system32\dllcache\dao360.dll + 2008-03-25 04:50:25 554,008 -c--a-w D:\WINDOWS\system32\dllcache\dao360.dll - 2008-02-20 05:38:07 148,992 -c--a-w D:\WINDOWS\system32\dllcache\dnsapi.dll + 2008-06-20 17:42:20 148,992 -c--a-w D:\WINDOWS\system32\dllcache\dnsapi.dll - 2008-02-16 09:05:11 357,888 -c--a-w D:\WINDOWS\system32\dllcache\dxtmsft.dll + 2008-06-23 15:41:36 357,888 -c--a-w D:\WINDOWS\system32\dllcache\dxtmsft.dll - 2008-02-16 09:05:11 205,312 -c--a-w D:\WINDOWS\system32\dllcache\dxtrans.dll + 2008-06-23 15:41:36 205,312 -c--a-w D:\WINDOWS\system32\dllcache\dxtrans.dll - 2005-07-26 04:42:34 243,200 -c--a-w D:\WINDOWS\system32\dllcache\es.dll + 2008-07-07 20:33:22 253,952 -c--a-w D:\WINDOWS\system32\dllcache\es.dll - 2008-02-16 09:05:11 55,808 -c--a-w D:\WINDOWS\system32\dllcache\extmgr.dll + 2008-06-23 15:41:36 55,808 -c--a-w D:\WINDOWS\system32\dllcache\extmgr.dll - 2008-02-15 09:23:37 18,432 -c--a-w D:\WINDOWS\system32\dllcache\iedw.exe + 2008-06-23 09:49:29 18,432 -c--a-w D:\WINDOWS\system32\dllcache\iedw.exe - 2008-02-16 09:05:11 251,392 -c--a-w D:\WINDOWS\system32\dllcache\iepeers.dll + 2008-06-23 15:41:36 251,392 -c--a-w D:\WINDOWS\system32\dllcache\iepeers.dll - 2007-08-21 06:18:06 683,520 -c--a-w D:\WINDOWS\system32\dllcache\inetcomm.dll + 2008-04-11 18:51:52 683,520 -c--a-w D:\WINDOWS\system32\dllcache\inetcomm.dll - 2008-02-16 09:05:11 96,768 -c--a-w D:\WINDOWS\system32\dllcache\inseng.dll + 2008-06-23 15:41:36 96,768 -c--a-w D:\WINDOWS\system32\dllcache\inseng.dll - 2008-02-16 09:05:11 16,384 -c--a-w D:\WINDOWS\system32\dllcache\jsproxy.dll + 2008-06-23 15:41:36 16,384 -c--a-w D:\WINDOWS\system32\dllcache\jsproxy.dll - 2004-08-03 22:44:04 331,776 -c--a-w D:\WINDOWS\system32\dllcache\msadce.dll + 2008-05-01 14:33:01 331,776 -c--a-w D:\WINDOWS\system32\dllcache\msadce.dll - 2005-06-29 01:52:57 74,240 -c--a-w D:\WINDOWS\system32\dllcache\mscms.dll + 2008-06-24 16:24:26 74,240 -c--a-w D:\WINDOWS\system32\dllcache\mscms.dll - 2004-08-03 22:44:04 512,029 -c--a-w D:\WINDOWS\system32\dllcache\msexch40.dll + 2008-03-25 04:50:28 518,944 -c--a-w D:\WINDOWS\system32\dllcache\msexch40.dll - 2004-08-03 22:44:06 319,517 -c--a-w D:\WINDOWS\system32\dllcache\msexcl40.dll + 2008-03-25 04:50:30 326,432 -c--a-w D:\WINDOWS\system32\dllcache\msexcl40.dll - 2008-02-16 22:35:14 3,080,704 -c--a-w D:\WINDOWS\system32\dllcache\mshtml.dll + 2008-06-23 15:41:37 3,080,704 -c--a-w D:\WINDOWS\system32\dllcache\mshtml.dll - 2008-02-16 09:05:13 449,024 -c--a-w D:\WINDOWS\system32\dllcache\mshtmled.dll + 2008-06-23 15:41:37 449,024 -c--a-w D:\WINDOWS\system32\dllcache\mshtmled.dll - 2004-08-03 22:44:06 1,507,356 -c--a-w D:\WINDOWS\system32\dllcache\msjet40.dll + 2008-03-25 04:50:34 1,516,568 -c--a-w D:\WINDOWS\system32\dllcache\msjet40.dll - 2004-07-17 09:34:48 358,976 -c--a-w D:\WINDOWS\system32\dllcache\msjetol1.dll + 2008-03-25 04:50:40 355,112 -c--a-w D:\WINDOWS\system32\dllcache\msjetol1.dll - 2004-08-03 22:44:06 172,063 -c--a-w D:\WINDOWS\system32\dllcache\msjint40.dll + 2008-03-25 04:52:02 178,976 -c--a-w D:\WINDOWS\system32\dllcache\msjint40.dll - 2004-08-03 22:44:06 53,279 -c--a-w D:\WINDOWS\system32\dllcache\msjter40.dll + 2008-03-25 04:50:42 60,192 -c--a-w D:\WINDOWS\system32\dllcache\msjter40.dll - 2004-08-03 22:44:06 241,693 -c--a-w D:\WINDOWS\system32\dllcache\msjtes40.dll + 2008-03-25 04:50:42 248,608 -c--a-w D:\WINDOWS\system32\dllcache\msjtes40.dll - 2004-08-03 22:44:06 213,023 -c--a-w D:\WINDOWS\system32\dllcache\msltus40.dll + 2008-03-25 04:50:44 219,936 -c--a-w D:\WINDOWS\system32\dllcache\msltus40.dll - 2004-08-03 22:44:06 348,189 -c--a-w D:\WINDOWS\system32\dllcache\mspbde40.dll + 2008-03-25 04:50:45 355,104 -c--a-w D:\WINDOWS\system32\dllcache\mspbde40.dll - 2008-02-16 09:05:13 146,432 -c--a-w D:\WINDOWS\system32\dllcache\msrating.dll + 2008-06-23 15:41:37 146,432 -c--a-w D:\WINDOWS\system32\dllcache\msrating.dll - 2004-08-03 22:44:06 421,919 -c--a-w D:\WINDOWS\system32\dllcache\msrd2x40.dll + 2008-03-25 04:50:47 432,928 -c--a-w D:\WINDOWS\system32\dllcache\msrd2x40.dll - 2004-08-03 22:44:06 315,423 -c--a-w D:\WINDOWS\system32\dllcache\msrd3x40.dll + 2008-03-25 04:50:49 322,336 -c--a-w D:\WINDOWS\system32\dllcache\msrd3x40.dll - 2004-08-03 22:44:06 552,989 -c--a-w D:\WINDOWS\system32\dllcache\msrepl40.dll + 2008-03-25 04:50:52 559,904 -c--a-w D:\WINDOWS\system32\dllcache\msrepl40.dll - 2004-08-03 22:44:06 258,077 -c--a-w D:\WINDOWS\system32\dllcache\mstext40.dll + 2008-03-25 04:50:55 264,992 -c--a-w D:\WINDOWS\system32\dllcache\mstext40.dll - 2008-02-16 09:05:13 532,480 -c--a-w D:\WINDOWS\system32\dllcache\mstime.dll + 2008-06-23 15:41:37 532,480 -c--a-w D:\WINDOWS\system32\dllcache\mstime.dll - 2004-08-03 22:44:06 831,519 -c--a-w D:\WINDOWS\system32\dllcache\mswdat10.dll + 2008-03-25 04:50:57 838,432 -c--a-w D:\WINDOWS\system32\dllcache\mswdat10.dll - 2004-08-03 22:44:06 246,784 -c--a-w D:\WINDOWS\system32\dllcache\mswsock.dll + 2008-06-20 17:42:21 246,784 -c--a-w D:\WINDOWS\system32\dllcache\mswsock.dll - 2004-08-03 22:44:06 614,429 -c--a-w D:\WINDOWS\system32\dllcache\mswstr10.dll + 2008-03-25 04:52:02 621,344 -c--a-w D:\WINDOWS\system32\dllcache\mswstr10.dll - 2004-08-03 22:44:06 348,189 -c--a-w D:\WINDOWS\system32\dllcache\msxbde40.dll + 2008-03-25 04:50:58 355,104 -c--a-w D:\WINDOWS\system32\dllcache\msxbde40.dll - 2008-02-16 09:05:14 39,424 -c--a-w D:\WINDOWS\system32\dllcache\pngfilt.dll + 2008-06-23 15:41:37 39,424 -c--a-w D:\WINDOWS\system32\dllcache\pngfilt.dll - 2007-10-29 22:44:30 1,291,264 -c--a-w D:\WINDOWS\system32\dllcache\quartz.dll + 2008-05-07 05:16:26 1,291,264 -c--a-w D:\WINDOWS\system32\dllcache\quartz.dll - 2006-07-13 08:48:58 202,240 -c--a-w D:\WINDOWS\system32\dllcache\rmcast.sys + 2008-05-08 12:28:49 202,752 -c--a-w D:\WINDOWS\system32\dllcache\rmcast.sys - 2008-02-16 09:05:15 1,494,528 -c--a-w D:\WINDOWS\system32\dllcache\shdocvw.dll + 2008-06-23 15:41:37 1,494,528 -c--a-w D:\WINDOWS\system32\dllcache\shdocvw.dll - 2008-02-16 09:05:15 474,112 -c--a-w D:\WINDOWS\system32\dllcache\shlwapi.dll + 2008-06-23 15:41:37 474,112 -c--a-w D:\WINDOWS\system32\dllcache\shlwapi.dll - 2007-10-30 17:20:55 360,064 -c--a-w D:\WINDOWS\system32\dllcache\tcpip.sys + 2008-06-20 10:45:13 360,320 -c--a-w D:\WINDOWS\system32\dllcache\tcpip.sys - 2006-08-16 09:37:30 225,664 -c--a-w D:\WINDOWS\system32\dllcache\tcpip6.sys + 2008-06-20 09:52:06 225,920 -c--a-w D:\WINDOWS\system32\dllcache\tcpip6.sys - 2008-02-16 09:05:15 616,960 -c--a-w D:\WINDOWS\system32\dllcache\urlmon.dll + 2008-06-23 15:41:37 616,960 -c--a-w D:\WINDOWS\system32\dllcache\urlmon.dll + 2004-08-03 20:58:46 15,104 -c--a-w D:\WINDOWS\system32\dllcache\usbscan.sys - 2008-02-16 09:05:15 662,016 -c--a-w D:\WINDOWS\system32\dllcache\wininet.dll + 2008-06-23 15:41:38 662,016 -c--a-w D:\WINDOWS\system32\dllcache\wininet.dll - 2007-07-30 18:19:36 549,720 -c--a-w D:\WINDOWS\system32\dllcache\wuapi.dll + 2008-07-18 20:09:44 563,912 -c--a-w D:\WINDOWS\system32\dllcache\wuapi.dll - 2007-07-30 18:19:16 53,080 -c--a-w D:\WINDOWS\system32\dllcache\wuauclt.exe + 2008-07-18 20:10:42 53,448 -c--a-w D:\WINDOWS\system32\dllcache\wuauclt.exe - 2007-07-30 18:19:42 1,712,984 -c--a-w D:\WINDOWS\system32\dllcache\wuaueng.dll + 2008-07-18 20:09:42 1,811,656 -c--a-w D:\WINDOWS\system32\dllcache\wuaueng.dll - 2007-07-30 18:19:32 325,976 -c--a-w D:\WINDOWS\system32\dllcache\wucltui.dll + 2008-07-18 20:09:46 325,832 -c--a-w D:\WINDOWS\system32\dllcache\wucltui.dll - 2007-07-30 18:19:28 203,096 -c--a-w D:\WINDOWS\system32\dllcache\wuweb.dll + 2008-07-18 20:09:44 205,000 -c--a-w D:\WINDOWS\system32\dllcache\wuweb.dll - 2008-02-20 05:38:07 148,992 ----a-w D:\WINDOWS\system32\dnsapi.dll + 2008-06-20 17:42:20 148,992 ----a-w D:\WINDOWS\system32\dnsapi.dll - 2004-08-03 21:14:16 138,496 ----a-w D:\WINDOWS\system32\drivers\afd.sys + 2008-06-20 10:44:38 138,368 ----a-w D:\WINDOWS\system32\drivers\afd.sys + 2008-06-14 18:01:34 273,024 ------w D:\WINDOWS\system32\drivers\bthport.sys + 2008-09-01 06:55:13 195,344 ----a-w D:\WINDOWS\system32\drivers\klif.sys + 2007-12-13 11:28:40 24,592 ----a-w D:\WINDOWS\system32\drivers\klim5.sys + 2007-12-17 22:43:02 23,396 ----a-w D:\WINDOWS\system32\drivers\klopp.dat - 2006-07-13 08:48:58 202,240 ----a-w D:\WINDOWS\system32\drivers\rmcast.sys + 2008-05-08 12:28:49 202,752 ----a-w D:\WINDOWS\system32\drivers\rmcast.sys - 2007-10-30 17:20:55 360,064 ----a-w D:\WINDOWS\system32\drivers\tcpip.sys + 2008-06-20 10:45:13 360,320 ----a-w D:\WINDOWS\system32\drivers\tcpip.sys - 2006-08-16 09:37:30 225,664 ----a-w D:\WINDOWS\system32\drivers\tcpip6.sys + 2008-06-20 09:52:06 225,920 ----a-w D:\WINDOWS\system32\drivers\tcpip6.sys + 2004-08-03 20:58:46 15,104 ----a-w D:\WINDOWS\system32\drivers\usbscan.sys - 2008-02-16 09:05:11 357,888 ----a-w D:\WINDOWS\system32\dxtmsft.dll + 2008-06-23 15:41:36 357,888 ----a-w D:\WINDOWS\system32\dxtmsft.dll - 2008-02-16 09:05:11 205,312 ----a-w D:\WINDOWS\system32\dxtrans.dll + 2008-06-23 15:41:36 205,312 ----a-w D:\WINDOWS\system32\dxtrans.dll - 2008-02-16 09:05:11 55,808 ----a-w D:\WINDOWS\system32\extmgr.dll + 2008-06-23 15:41:36 55,808 ----a-w D:\WINDOWS\system32\extmgr.dll - 2008-02-16 09:05:11 251,392 ----a-w D:\WINDOWS\system32\iepeers.dll + 2008-06-23 15:41:36 251,392 ----a-w D:\WINDOWS\system32\iepeers.dll - 2007-08-21 06:18:06 683,520 ----a-w D:\WINDOWS\system32\inetcomm.dll + 2008-04-11 18:51:52 683,520 ----a-w D:\WINDOWS\system32\inetcomm.dll - 2008-02-16 09:05:11 96,768 ----a-w D:\WINDOWS\system32\inseng.dll + 2008-06-23 15:41:36 96,768 ----a-w D:\WINDOWS\system32\inseng.dll - 2008-02-16 09:05:11 16,384 ----a-w D:\WINDOWS\system32\jsproxy.dll + 2008-06-23 15:41:36 16,384 ----a-w D:\WINDOWS\system32\jsproxy.dll + 2007-12-17 22:44:54 219,664 ----a-w D:\WINDOWS\system32\klogon.dll - 2004-08-03 22:44:04 512,029 ----a-w D:\WINDOWS\system32\msexch40.dll + 2008-03-25 04:50:28 518,944 ----a-w D:\WINDOWS\system32\msexch40.dll - 2004-08-03 22:44:06 319,517 ----a-w D:\WINDOWS\system32\msexcl40.dll + 2008-03-25 04:50:30 326,432 ----a-w D:\WINDOWS\system32\msexcl40.dll - 2008-02-16 22:35:14 3,080,704 ----a-w D:\WINDOWS\system32\mshtml.dll + 2008-06-23 15:41:37 3,080,704 ----a-w D:\WINDOWS\system32\mshtml.dll - 2008-02-16 09:05:13 449,024 ----a-w D:\WINDOWS\system32\mshtmled.dll + 2008-06-23 15:41:37 449,024 ----a-w D:\WINDOWS\system32\mshtmled.dll - 2004-08-03 22:44:06 1,507,356 ----a-w D:\WINDOWS\system32\msjet40.dll + 2008-03-25 04:50:34 1,516,568 ----a-w D:\WINDOWS\system32\msjet40.dll - 2004-07-17 09:34:48 358,976 ----a-w D:\WINDOWS\system32\msjetoledb40.dll + 2008-03-25 04:50:40 355,112 ----a-w D:\WINDOWS\system32\msjetoledb40.dll - 2004-08-03 22:44:06 172,063 ----a-w D:\WINDOWS\system32\msjint40.dll + 2008-03-25 04:52:02 178,976 ----a-w D:\WINDOWS\system32\msjint40.dll - 2004-08-03 22:44:06 53,279 ----a-w D:\WINDOWS\system32\msjter40.dll + 2008-03-25 04:50:42 60,192 ----a-w D:\WINDOWS\system32\msjter40.dll - 2004-08-03 22:44:06 241,693 ----a-w D:\WINDOWS\system32\msjtes40.dll + 2008-03-25 04:50:42 248,608 ----a-w D:\WINDOWS\system32\msjtes40.dll - 2004-08-03 22:44:06 213,023 ----a-w D:\WINDOWS\system32\msltus40.dll + 2008-03-25 04:50:44 219,936 ----a-w D:\WINDOWS\system32\msltus40.dll - 2004-08-03 22:44:06 348,189 ----a-w D:\WINDOWS\system32\mspbde40.dll + 2008-03-25 04:50:45 355,104 ----a-w D:\WINDOWS\system32\mspbde40.dll - 2008-02-16 09:05:13 146,432 ----a-w D:\WINDOWS\system32\msrating.dll + 2008-06-23 15:41:37 146,432 ----a-w D:\WINDOWS\system32\msrating.dll - 2004-08-03 22:44:06 421,919 ----a-w D:\WINDOWS\system32\msrd2x40.dll + 2008-03-25 04:50:47 432,928 ----a-w D:\WINDOWS\system32\msrd2x40.dll - 2004-08-03 22:44:06 315,423 ----a-w D:\WINDOWS\system32\msrd3x40.dll + 2008-03-25 04:50:49 322,336 ----a-w D:\WINDOWS\system32\msrd3x40.dll - 2004-08-03 22:44:06 552,989 ----a-w D:\WINDOWS\system32\msrepl40.dll + 2008-03-25 04:50:52 559,904 ----a-w D:\WINDOWS\system32\msrepl40.dll - 2004-08-03 22:44:06 258,077 ----a-w D:\WINDOWS\system32\mstext40.dll + 2008-03-25 04:50:55 264,992 ----a-w D:\WINDOWS\system32\mstext40.dll - 2008-02-16 09:05:13 532,480 ----a-w D:\WINDOWS\system32\mstime.dll + 2008-06-23 15:41:37 532,480 ----a-w D:\WINDOWS\system32\mstime.dll - 2004-08-03 22:44:06 831,519 ----a-w D:\WINDOWS\system32\mswdat10.dll + 2008-03-25 04:50:57 838,432 ----a-w D:\WINDOWS\system32\mswdat10.dll - 2004-08-03 22:44:06 614,429 ----a-w D:\WINDOWS\system32\mswstr10.dll + 2008-03-25 04:52:02 621,344 ----a-w D:\WINDOWS\system32\mswstr10.dll - 2004-08-03 22:44:06 348,189 ----a-w D:\WINDOWS\system32\msxbde40.dll + 2008-03-25 04:50:58 355,104 ----a-w D:\WINDOWS\system32\msxbde40.dll - 2008-02-16 09:05:14 39,424 ----a-w D:\WINDOWS\system32\pngfilt.dll + 2008-06-23 15:41:37 39,424 ----a-w D:\WINDOWS\system32\pngfilt.dll + 2001-10-26 15:29:42 5,632 ----a-w D:\WINDOWS\system32\ptpusb.dll + 2004-08-03 22:44:10 159,232 ----a-w D:\WINDOWS\system32\ptpusd.dll - 2007-10-29 22:44:30 1,291,264 ----a-w D:\WINDOWS\system32\quartz.dll + 2008-05-07 05:16:26 1,291,264 ----a-w D:\WINDOWS\system32\quartz.dll - 2008-02-16 09:05:15 1,494,528 ----a-w D:\WINDOWS\system32\shdocvw.dll + 2008-06-23 15:41:37 1,494,528 ----a-w D:\WINDOWS\system32\shdocvw.dll - 2008-02-16 09:05:15 474,112 ----a-w D:\WINDOWS\system32\shlwapi.dll + 2008-06-23 15:41:37 474,112 ----a-w D:\WINDOWS\system32\shlwapi.dll + 2008-07-18 20:10:20 36,552 ----a-w D:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.784\wups.dll + 2008-07-18 20:10:40 45,768 ----a-w D:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.784\wups2.dll - 2006-09-25 15:58:48 14,640 ------w D:\WINDOWS\system32\spmsg.dll + 2007-11-30 12:40:46 19,320 ------w D:\WINDOWS\system32\spmsg.dll - 2007-11-13 11:31:11 60,416 ------w D:\WINDOWS\system32\tzchange.exe + 2008-07-14 11:09:18 62,976 ------w D:\WINDOWS\system32\tzchange.exe - 2008-02-16 09:05:15 616,960 ----a-w D:\WINDOWS\system32\urlmon.dll + 2008-06-23 15:41:37 616,960 ----a-w D:\WINDOWS\system32\urlmon.dll - 2008-02-15 23:03:24 369,152 ----a-w D:\WINDOWS\system32\xpsp3res.dll + 2008-07-03 09:42:47 369,152 ----a-w D:\WINDOWS\system32\xpsp3res.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "MSMSGS"="D:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [2006-10-22 7700480] "NvMediaCenter"="D:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 86016] "NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "Sony Ericsson PC Suite"="D:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-24 487424] "Samsung Common SM"="D:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" [2005-07-03 372736] "SkyTel"="SkyTel.EXE" [2006-05-16 D:\WINDOWS\SkyTel.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-08-01 D:\WINDOWS\RTHDCPL.EXE] "nwiz"="nwiz.exe" [2006-10-22 D:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] "Picasa Media Detector"="D:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 443968] D:\Documents and Settings\user\Menu Start\Programy\Autostart\ PopTray.lnk - D:\Program Files\PopTray\PopTray.exe [2006-09-16 1666048] D:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - D:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-05-29 962661] Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i263_32.drv [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\BearShare\\BearShare.exe"= "C:\\Program Files\\BearFlix\\bearflix.exe"= "D:\\Program Files\\Ares\\Ares.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\Program Files\\QIP\\qip.exe"= "D:\\Program Files\\uTorrent\\uTorrent.exe"= "D:\\Program Files\\SecondLife\\SLVoice.exe"= "C:\\Sev\\Codemasters\\Blade of Darkness\\Bin\\Blade.exe"= "D:\\Program Files\\Skype\\Phone\\Skype.exe"= "D:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\Polish\\setup.exe"= "D:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.321\\English\\setup.exe"= R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;D:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2006-07-28 34944] R3 klim5;Kaspersky Anti-Virus NDIS Filter;D:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 24592] S3 ADM8511;Konwerter z USB na Fast Ethernet ADMtek ADM8511/AN986;D:\WINDOWS\system32\DRIVERS\ADM8511.SYS [2001-08-17 20160] S3 AvFlt;Antivirus Filter Driver;D:\WINDOWS\system32\drivers\av5flt.sys [ ] . - - - - ORPHANS REMOVED - - - - HKLM-Run-CafeNews - D:\Program Files\CafeNews\CN.exe . ------- Supplementary Scan ------- . FireFox -: Profile - D:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\qhg9q3fj.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://pl.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pl:official . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-04 18:54:48 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2008-09-04 18:56:53 ComboFix-quarantined-files.txt 2008-09-04 16:55:51 ComboFix2.txt 2008-05-01 08:49:26 ComboFix3.txt 2008-05-01 08:45:07 Pre-Run: 10,243,137,536 bajtów wolnych Post-Run: 10,536,177,664 bajtów wolnych 513 --- E O F --- 2008-08-15 17:30:42

**Posty:** 684 · przez **djarta** 04 Wrz 2008, 19:03

Ja nie widzę tu nic szkodliwego.

Wykonaj to co jest podane w tym temacie (jeśli wykonałeś/łaś to wcześniej to nie rób tego).

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

===============================
K.