Witamy na forum PC Format Zapraszamy do REJESTRACJI


Użytkownicy przeglądający ten wątek: 1 gości

wirus cvasds0.dll

#1
wirus cvasds0.dll
Witam,

Wskoczył mi dzisiaj wirus cvasds0.dll bodajże przy instalacji daemon tools i nie mogę sobie z nim poradzić. Pomoże ktoś bo nie mam pojęcia jak sie go pozbyć. wyczytałem już że przydadzą się logi z RSIT więc wrzucam. Z góry dziękuje za pomoc

http://www.wklej.org/id/260981/
 System operacyjny: windows_xp_2003 Przeglądarka: firefox
#2
RE: wirus cvasds0.dll
zaznacz w HJT (c>program files>trend micro>) i kliknij fix
Kod:
O4 - HKCU\..\Run: [cdoosoft] C:\DOCUME~1\Marian\USTAWI~1\Temp\herss.exe

pobierz AFT Cleaner i zaznacz 3 pierwsze fajki i czyść

reszta będzie za chwilkę.

przydałby się OTL
 System operacyjny: windows_xp_2003 Przeglądarka: firefox
#3
RE: wirus cvasds0.dll
Zrobiłem tak jak napisałeś, wirus wyskakiwał przy uruchomieniu kompa, teraz po tych HJT i ATF nic sie nie pokazało... Po problemie w takim razie?

Daje OTL żeby było wszystko w porządku.

http://wklej.org/id/261037/

Jeżeli jest po problemie to dziekuje za pomoc a jeżeli nie to prosze o kolejne wskazówki Wesoły
 System operacyjny: windows_xp_2003 Przeglądarka: firefox
#4
RE: wirus cvasds0.dll
pobierz MBAM + a-squared free. zrób aktualizacje i wykonaj skanowanie. w mbam co znajdzie to usuń, w a-squared free (do kwarantanny) i daj wyniki skanowania.
Kod:
C:\WINDOWS\System32\WooDial2000.dll
przesknuj na http://www.virscan.org
 System operacyjny: windows_xp_2003 Przeglądarka: firefox
#5
RE: wirus cvasds0.dll
MBAM
Kod:
Malwarebytes' Anti-Malware 1.44
Wersja bazy definicji: 3510
Windows 5.1.2600 Dodatek Service Pack 2
Internet Explorer 6.0.2900.2180

2010-01-09 16:49:16
mbam-log-2010-01-09 (16-49-13).txt

Typ skanowania: Pełne skanowanie (C:\|D:\|E:\|)
Przeskanowane obiekty: 130298
Upłynęło: 10 minute(s), 49 second(s)

Zainfekowane procesy w pamięci: 0
Zainfekowane moduły pamięci: 0
Zainfekowane klucze rejestru: 0
Zainfekowane wartości rejestru: 0
Zainfekowane pliki rejestru: 0
Zainfekowane foldery: 0
Zainfekowane pliki: 1

Zainfekowane procesy w pamięci:
(Nie wykryto groźnych plików)

Zainfekowane moduły pamięci:
(Nie wykryto groźnych plików)

Zainfekowane klucze rejestru:
(Nie wykryto groźnych plików)

Zainfekowane wartości rejestru:
(Nie wykryto groźnych plików)

Zainfekowane pliki rejestru:
(Nie wykryto groźnych plików)

Zainfekowane foldery:
(Nie wykryto groźnych plików)

Zainfekowane pliki:
C:\Documents and Settings\Marian\Ustawienia lokalne\Temp\herss.exe (Spyware.OnlineGames) -> No action taken.
Kod:
a-squared Free - wersja %S 4.5
Ost. aktualizacja: 2010-01-09 16:54:35

Ustawienia skanu:

Typ skanu: Gruntowny skan
Obiekty: Pamięć, Ślady, Ciastka, C:\, D:\, E:\
Skan archiw: Włącz
Heurestyka: Wyłącz
Skan reklam: Włącz

Skan wystartował:    2010-01-09 16:55:02

c:\program files\common files\whenu     Wykryto: Trace.Directory.WhenU.WeatherCast!A2
c:\program files\daemon tools searchbar     Wykryto: Trace.Directory.WhenU-DesktopBar!A2
Value: HKEY_USERS\S-1-5-21-1935655697-1220945662-839522115-1003\Software\KLExtensions\Tools --> Cmd1     Wykryto: Trace.Registry.Kazaa Lite Resurrection!A2
Value: HKEY_USERS\S-1-5-21-1935655697-1220945662-839522115-1003\Software\KLExtensions\Tools --> Preview1     Wykryto: Trace.Registry.Kazaa Lite Resurrection!A2
Value: HKEY_USERS\S-1-5-21-1935655697-1220945662-839522115-1003\Software\KLExtensions\Tools --> Title1     Wykryto: Trace.Registry.Kazaa Lite Resurrection!A2
c:\program files\daemon tools searchbar\search.htm     Wykryto: Trace.File.WhenU-DesktopBar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhenUSearch --> DisplayIcon     Wykryto: Trace.Registry.WhenU-DesktopBar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhenUSearch --> DisplayName     Wykryto: Trace.Registry.WhenU-DesktopBar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhenUSearch --> DisplayVersion     Wykryto: Trace.Registry.WhenU-DesktopBar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhenUSearch --> HelpLink     Wykryto: Trace.Registry.WhenU-DesktopBar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhenUSearch --> Publisher     Wykryto: Trace.Registry.WhenU-DesktopBar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhenUSearch --> UninstallString     Wykryto: Trace.Registry.WhenU-DesktopBar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhenUSearch --> UrlInfoAbout     Wykryto: Trace.Registry.WhenU-DesktopBar!A2
Key: HKEY_CLASSES_ROOT\clsid\{763bd795-24ae-44d7-82d8-f9a1ee799729}     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run --> whenusearch     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run --> whenusearchwhse     Wykryto: Trace.Registry.WhenUSearch!A2
Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\whenusearch     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch\Partners\desktop --> InstallTime     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch\Partners\desktop --> LastPartner     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch\Partners\desktop --> Partner     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch\Partners\desktop --> PartnerDesc     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch\Partners\desktop --> SetupCmdLine     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch\WHSE --> exitsurvey_url     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch\WHSE --> Installed_rs     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch\WHSE --> InstallTime     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch\WHSE --> LastPartner     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch\WHSE --> Partner     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch\WHSE --> SetupCmdLine     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch\WHSE --> showSplash     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch\WHSE --> uiver_rs     Wykryto: Trace.Registry.WhenUSearch!A2
Key: HKEY_LOCAL_MACHINE\software\whenusearch     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch --> coupondataurl     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\software\whenusearch --> installdir     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\software\whenusearch --> installtime     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch --> iptomsa_url     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch --> pat_chunks_url     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch --> pats_url     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch --> update_url     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\software\whenusearch --> version     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\software\whenusearch --> zip     Wykryto: Trace.Registry.WhenUSearch!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch --> ziptomsa_url     Wykryto: Trace.Registry.WhenUSearch!A2
C:\Documents and Settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\cookies.sqlite:1262994350175005     Wykryto: Trace.TrackingCookie.doubleclick.net!A2
C:\Documents and Settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\cookies.sqlite:1263035247953000     Wykryto: Trace.TrackingCookie.ad.yieldmanager.com!A2
C:\Documents and Settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\cookies.sqlite:1263035247953001     Wykryto: Trace.TrackingCookie.ad.yieldmanager.com!A2
C:\Documents and Settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\cookies.sqlite:1263035247953002     Wykryto: Trace.TrackingCookie.ad.yieldmanager.com!A2
C:\Documents and Settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\cookies.sqlite:1263035247953003     Wykryto: Trace.TrackingCookie.ad.yieldmanager.com!A2
C:\Documents and Settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\cookies.sqlite:1263035247953004     Wykryto: Trace.TrackingCookie.ad.yieldmanager.com!A2
C:\Documents and Settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\cookies.sqlite:1263035247953005     Wykryto: Trace.TrackingCookie.ad.yieldmanager.com!A2
C:\Documents and Settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\cookies.sqlite:1263035271328000     Wykryto: Trace.TrackingCookie.clicktorrent.info!A2
C:\Documents and Settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\cookies.sqlite:1263035271328001     Wykryto: Trace.TrackingCookie.clicktorrent.info!A2
C:\Documents and Settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\cookies.sqlite:1263035272656000     Wykryto: Trace.TrackingCookie.adserv!A2
C:\Documents and Settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\cookies.sqlite:1263035273000000     Wykryto: Trace.TrackingCookie.clicktorrent.info!A2
C:\Documents and Settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\cookies.sqlite:1263035273000001     Wykryto: Trace.TrackingCookie.clicktorrent.info!A2
C:\Documents and Settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\cookies.sqlite:1263035273000002     Wykryto: Trace.TrackingCookie.clicktorrent.info!A2
C:\Documents and Settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\cookies.sqlite:1263035273437001     Wykryto: Trace.TrackingCookie.clicktorrent.info!A2
C:\Documents and Settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\cookies.sqlite:1263035273437002     Wykryto: Trace.TrackingCookie.clicktorrent.info!A2
C:\Documents and Settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\cookies.sqlite:1263035273437003     Wykryto: Trace.TrackingCookie.clicktorrent.info!A2
C:\Documents and Settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\cookies.sqlite:1263051199640000     Wykryto: Trace.TrackingCookie.ad.doubleclick.net!A2
C:\autorun.inf     Wykryto: Trojan-GameThief.Win32.Magania!IK
C:\Program Files\Common Files\WhenU\DTPlugin.dll     Wykryto: Gen.AdWare!IK
C:\Program Files\DAEMON Tools SearchBar\search.htm     Wykryto: AdWare.WhenUSearch.G!IK
D:\autorun.inf     Wykryto: Trojan-GameThief.Win32.Magania!IK
D:\e9naq.exe     Wykryto: Trojan-PWS.OnlineGames_r!IK
D:\Programy\blz-a120_1953823-patch.exe     Wykryto: Riskware.Patch.Alcohol!IK
D:\Programy\Programy\USDownloader CANCER®.exe/AntiCaptcha.exe     Wykryto: Backdoor.Win32.IRCBot!IK
D:\Programy\Programy\USDownloader CANCER®.exe/livebox.exe     Wykryto: Trojan-Proxy.Win32.Delf.bx!IK
D:\Programy\Programy\USDownloader CANCER®.exe/BinFile.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/DataCodRuHA.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/DataCodRuP.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/Datenko.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/DepositFilesP.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/DivShare.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/Dumpru.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/EasySharingHA.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/Ediskcz.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/FileFactoryHA.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/FileFactoryP.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/FileFlyer.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/FilePost.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/FileShareInUa.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/FileSpace.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/Filesto.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/FlyUpload.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/Ftp2Share.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/IceFile.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/IceFileOrg.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/iFolder.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/Letitbit.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/LoadTo.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/MegaRotic.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/MegaShares.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/MegaUpload.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/Mihd.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/MusicFond.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/MyTempDir.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/OpenFileRu.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/OxyShare.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/RapidShareCom.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/RapidShareComP.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/RuRapid.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/SaveFile.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/SendSpace.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/SharaBy.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/ShareUa.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/SimpleUpload.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/SpeedyShare.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/SwapFileRu.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/UniversalVideo.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/Uploadedto.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/UploadingHA.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/WebFile.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/ZippyShare.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\Programy\USDownloader CANCER®.exe/zShare.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/AntiCaptcha.exe     Wykryto: Backdoor.Win32.IRCBot!IK
D:\Programy\USDownloader CANCER®.exe/livebox.exe     Wykryto: Trojan-Proxy.Win32.Delf.bx!IK
D:\Programy\USDownloader CANCER®.exe/BinFile.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/DataCodRuHA.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/DataCodRuP.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/Datenko.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/DepositFilesP.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/DivShare.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/Dumpru.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/EasySharingHA.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/Ediskcz.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/FileFactoryHA.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/FileFactoryP.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/FileFlyer.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/FilePost.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/FileShareInUa.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/FileSpace.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/Filesto.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/FlyUpload.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/Ftp2Share.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/IceFile.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/IceFileOrg.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/iFolder.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/Letitbit.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/LoadTo.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/MegaRotic.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/MegaShares.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/MegaUpload.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/Mihd.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/MusicFond.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/MyTempDir.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/OpenFileRu.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/OxyShare.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/RapidShareCom.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/RapidShareComP.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/RuRapid.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/SaveFile.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/SendSpace.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/SharaBy.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/ShareUa.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/SimpleUpload.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/SpeedyShare.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/SwapFileRu.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/UniversalVideo.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/Uploadedto.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/UploadingHA.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/WebFile.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/ZippyShare.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\USDownloader CANCER®.exe/zShare.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/BinFile.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/DataCodRuHA.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/DivShare.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/Dumpru.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/EasySharingHA.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/Ediskcz.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/FileFactoryHA.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/FileFlyer.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/FilePost.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/FileShareInUa.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/FlyUpload.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/Ftp2Share.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/IceFile.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/iFolder.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/MegaShares.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/Mihd.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/MusicFond.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/Netloadin.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/OpenFileRu.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/OxyShare.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/Paid4Share.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/RapidShareCom.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/RuRapid.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/SimpleUpload.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/SpeedyShare.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/UniversalVideo.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/Uploadedto.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/UploadingHA.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/zShare.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/DataCodRuP.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/DepositFilesP.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/FileFactoryP.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
D:\Programy\UsDownloader.rar/RapidShareComP.plg     Wykryto: Trojan-PWS.Win32.Delf!IK
E:\autorun.inf     Wykryto: Trojan-GameThief.Win32.Magania!IK
E:\e9naq.exe     Wykryto: Trojan-PWS.OnlineGames_r!IK

Przeskanowano

Pliki:     154030
Ślady:     650735
Ciastka:     388
Procesy:     40

Wykryte

Pliki:     139
Ślady:     41
Ciastka:     19
Procesy:     0
Klucze rejestru:     0

Koniec skanu:    2010-01-09 17:16:56
Skan trwał:    0:21:54

Jak chciałem przenieść pliki do kwarantanny to nie wszystkie się dało… w sumie nie dało się tych z USDownloader … w ogóle nie wiem skąd się ten downloader u mnie wziąłKwaśny musiał brat coś zadziałać...
virscan nic nie znalazł... "Wszystkie skanery zgłosiły brak szkodliwego oprogramowania!"
 System operacyjny: windows_xp_2003 Przeglądarka: firefox
#6
RE: wirus cvasds0.dll
Ponieważ Dumbass ma mało czasu podpowiem co nie co. (pozdro dla Dumbassa).
Proponuję zapoznać się z tym tematem: http://www.searchengines.pl/index.php?sh...ntry395642



Do notatnika wklej taki tekst bez frazy kod:

Kod:
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"cdoosoft"=-
[ -HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3a80f287-fcb7-11de-878c-4d6564696130}]

Plik zapisz jako/zmień rozszerzenie na wszystkie pliki/zapisz jako fix.reg/dwuklikiem dodajesz do rejestru.


Zastosuj Combofix'a (instalując podkreślam konsolkę odzyskiwania). I poprosimy z niego log.
 System operacyjny: windows_xp_2003 Przeglądarka: firefox
#7
RE: wirus cvasds0.dll
Takie coś mi wyszło z Combofix'a


Kod:
ComboFix 10-01-04.01 - Marian 2010-01-09  18:38:03.2.2 - x86
Microsoft Windows XP Professional  5.1.2600.2.1250.48.1045.18.3070.2684 [GMT 1:00]
Uruchomiony z: c:\documents and settings\Marian\Pulpit\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100108-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((((((((((((   Pliki utworzone od 2009-12-09 do 2010-01-09  )))))))))))))))))))))))))))))))
.

2010-01-09 15:52 . 2010-01-09 16:16    --------    d-----w-    c:\program files\a-squared Free
2010-01-09 15:36 . 2010-01-09 15:36    --------    d-----w-    c:\documents and settings\Marian\Dane aplikacji\Malwarebytes
2010-01-09 15:36 . 2010-01-07 15:07    38224    ----a-w-    c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-09 15:36 . 2010-01-09 15:36    --------    d-----w-    c:\program files\Malwarebytes' Anti-Malware
2010-01-09 15:36 . 2010-01-09 15:36    --------    d-----w-    c:\documents and settings\All Users\Dane aplikacji\Malwarebytes
2010-01-09 15:36 . 2010-01-07 15:07    19160    ----a-w-    c:\windows\system32\drivers\mbam.sys
2010-01-09 15:10 . 2010-01-09 15:10    --------    d-----w-    c:\program files\Eidos Interactive
2010-01-09 15:08 . 2010-01-09 16:19    --------    d-----w-    c:\program files\Common Files\WhenU
2010-01-09 15:07 . 2010-01-09 16:19    --------    d-----w-    c:\program files\DAEMON Tools SearchBar
2010-01-09 14:17 . 2010-01-09 14:51    --------    d-----w-    c:\program files\trend micro
2010-01-09 14:17 . 2010-01-09 14:17    --------    d-----w-    C:\rsit
2010-01-09 14:01 . 2010-01-09 14:01    --------    d-----w-    C:\_OTL
2010-01-09 13:01 . 2010-01-09 13:01    721904    ----a-w-    c:\windows\system32\drivers\sptd.sys
2010-01-09 13:01 . 2010-01-09 13:01    --------    d-----w-    c:\documents and settings\Marian\Dane aplikacji\DAEMON Tools Lite
2010-01-09 11:08 . 2010-01-09 12:14    --------    d-----w-    c:\documents and settings\Marian\Dane aplikacji\BitTorrent
2010-01-09 11:06 . 2010-01-09 11:06    --------    d-----w-    c:\program files\BitTorrent
2010-01-09 10:58 . 2010-01-09 10:58    --------    d-----w-    c:\program files\Microsoft Works
2010-01-09 10:56 . 2010-01-09 10:57    --------    d-----w-    c:\windows\SHELLNEW
2010-01-09 10:56 . 2010-01-09 10:56    --------    d-----w-    c:\documents and settings\Marian\Ustawienia lokalne\Dane aplikacji\Microsoft Help
2010-01-09 10:56 . 2010-01-09 10:59    --------    d-----w-    c:\documents and settings\All Users\Dane aplikacji\Microsoft Help
2010-01-09 10:55 . 2010-01-09 10:55    --------    d-----r-    C:\MSOCache
2010-01-09 10:00 . 2010-01-09 10:00    --------    d-----w-    C:\HattrickOrganizer
2010-01-09 09:02 . 2010-01-09 09:02    --------    d-----w-    c:\windows\system32\LogFiles
2010-01-09 00:37 . 2010-01-09 11:01    --------    d-----w-    c:\program files\JDownloader
2010-01-09 00:13 . 2010-01-09 00:13    --------    d-----w-    c:\program files\Common Files\Java
2010-01-09 00:11 . 2010-01-09 00:11    411368    ----a-w-    c:\windows\system32\deploytk.dll
2010-01-09 00:11 . 2010-01-09 00:16    152576    ----a-w-    c:\documents and settings\Marian\Dane aplikacji\Sun\Java\jre1.6.0_17\lzma.dll
2010-01-09 00:09 . 2010-01-09 00:14    79488    ----a-w-    c:\documents and settings\Marian\Dane aplikacji\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-09 00:05 . 2010-01-09 00:05    --------    d-----w-    c:\program files\Media Player Classic
2010-01-09 00:05 . 2010-01-09 00:05    --------    d-----w-    c:\program files\Real Alternative
2010-01-09 00:04 . 2010-01-09 00:04    --------    d-----w-    C:\totalcmd
2010-01-09 00:04 . 2006-07-26 05:55    545    ----a-w-    c:\windows\UC.PIF
2010-01-09 00:04 . 2006-07-26 05:55    545    ----a-w-    c:\windows\RAR.PIF
2010-01-09 00:04 . 2006-07-26 05:55    545    ----a-w-    c:\windows\PKZIP.PIF
2010-01-09 00:04 . 2006-07-26 05:55    545    ----a-w-    c:\windows\PKUNZIP.PIF
2010-01-09 00:04 . 2006-07-26 05:55    545    ----a-w-    c:\windows\NOCLOSE.PIF
2010-01-09 00:04 . 2006-07-26 05:55    545    ----a-w-    c:\windows\LHA.PIF
2010-01-09 00:04 . 2006-07-26 05:55    545    ----a-w-    c:\windows\ARJ.PIF
2010-01-09 00:04 . 2010-01-09 00:04    --------    d-----w-    c:\program files\VSO
2010-01-09 00:03 . 2010-01-09 00:03    --------    d-----w-    c:\program files\SLD Codec Pack
2010-01-09 00:03 . 2010-01-09 00:03    --------    d-----w-    c:\program files\foobar2000
2010-01-09 00:01 . 2010-01-09 00:01    --------    d-----w-    c:\documents and settings\Marian\Gadu-Gadu
2010-01-09 00:01 . 2010-01-09 00:01    --------    d-----w-    c:\program files\Gadu-Gadu
2010-01-09 00:00 . 2010-01-09 17:29    --------    d-----w-    c:\program files\AutoConnect

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-09 17:31 . 2010-01-08 22:42    17488    ----a-w-    c:\windows\gdrv.sys
2010-01-09 17:29 . 2010-01-08 23:36    --------    d-----w-    c:\program files\neostrada tp
2010-01-09 15:10 . 2010-01-08 22:33    --------    d--h--w-    c:\program files\InstallShield Installation Information
2010-01-09 15:10 . 2010-01-08 22:33    --------    d-----w-    c:\program files\Common Files\InstallShield
2010-01-09 00:14 . 2010-01-08 23:37    --------    d-----w-    c:\program files\Java
2010-01-08 23:59 . 2001-10-26 17:15    49712    ----a-w-    c:\windows\system32\perfc015.dat
2010-01-08 23:59 . 2001-10-26 17:15    355830    ----a-w-    c:\windows\system32\perfh015.dat
2010-01-08 23:53 . 2010-01-08 23:53    --------    d-----w-    c:\program files\ALLPlayer
2010-01-08 23:51 . 2010-01-08 23:51    12328    ----a-w-    c:\documents and settings\Marian\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2010-01-08 23:49 . 2010-01-08 23:49    --------    d-----w-    c:\program files\Alwil Software
2010-01-08 23:45 . 2010-01-08 23:45    0    ----a-w-    c:\windows\nsreg.dat
2010-01-08 23:38 . 2010-01-08 23:38    33    ----a-w-    c:\windows\system32\drivers\adidsl.cfg
2010-01-08 23:38 . 2010-01-08 23:38    --------    d-----w-    c:\program files\SAGEM
2010-01-08 22:49 . 2010-01-08 22:49    --------    d-----w-    c:\program files\AGEIA Technologies
2010-01-08 22:49 . 2010-01-08 22:49    --------    d-----w-    c:\program files\Common Files\Wise Installation Wizard
2010-01-08 22:46 . 2010-01-08 22:46    --------    d-----w-    c:\program files\EXPERTool
2010-01-08 22:43 . 2010-01-08 22:40    --------    d-----w-    c:\documents and settings\All Users\Dane aplikacji\Symantec
2010-01-08 22:43 . 2010-01-08 22:40    --------    d-----w-    c:\documents and settings\All Users\Dane aplikacji\Norton
2010-01-08 22:39 . 2010-01-08 22:39    --------    d-----w-    c:\documents and settings\All Users\Dane aplikacji\NortonInstaller
2010-01-08 22:36 . 2010-01-08 22:36    --------    d-----w-    c:\program files\Realtek
2010-01-08 22:34 . 2010-01-08 22:34    --------    d-----w-    c:\program files\Intel
2010-01-08 22:34 . 2010-01-08 22:34    --------    d--h--w-    c:\program files\DeviceVM
2010-01-08 22:33 . 2010-01-08 22:33    --------    d-----w-    c:\program files\Gigabyte
2010-01-08 22:27 . 2010-01-08 22:27    --------    d-----w-    c:\program files\microsoft frontpage
2010-01-08 22:26 . 2010-01-08 22:26    86327    ----a-w-    c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-08 22:26 . 2010-01-08 22:26    --------    d-----w-    c:\program files\Usługi online
2010-01-08 22:24 . 2010-01-08 22:24    21856    ----a-w-    c:\windows\system32\emptyregdb.dat
2009-11-24 23:54 . 2010-01-08 23:49    1280480    ----a-w-    c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2010-01-08 23:49    93424    ----a-w-    c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:50 . 2010-01-08 23:49    94160    ----a-w-    c:\windows\system32\drivers\aswmon2.sys
2009-11-24 23:50 . 2010-01-08 23:49    114768    ----a-w-    c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2010-01-08 23:49    20560    ----a-w-    c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2010-01-08 23:49    48560    ----a-w-    c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2010-01-08 23:49    23120    ----a-w-    c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2010-01-08 23:49    27408    ----a-w-    c:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2010-01-08 23:49    97480    ----a-w-    c:\windows\system32\AvastSS.scr
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane  
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2009-05-12 2181672]
"AutoConnect"="c:\program files\AutoConnect\AutoConnect.exe" [2006-12-02 310784]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-01-16 1716224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCU"="c:\program files\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-08-04 346320]
"RTHDCPL"="RTHDCPL.EXE" [2009-06-25 17887232]
"nwiz"="nwiz.exe" [2009-06-10 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-06-10 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-10 13758464]
"WOOWATCH"="c:\progra~1\NEOSTR~1\Watch.exe" [2004-08-23 20480]
"WOOTASKBARICON"="c:\progra~1\NEOSTR~1\GestMaj.exe" [2004-10-14 32768]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-09 00:11    149280    ----a-w-    c:\program files\Java\jre6\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2010-01-09 114768]
R2 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [2010-01-09 1858144]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-01-09 20560]
R2 BCUService;Browser Configuration Utility Service;c:\program files\DeviceVM\Browser Configuration Utility\BCUService.exe [2010-01-08 219360]
R2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [2010-01-08 68136]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [2010-01-08 44032]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2010-01-09 721904]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2010-01-08 1684736]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.ask.com?o=15458&l=dis
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: { - c:\program files\Messenger\msmsgs.exe
TCP: {51E4FF40-042D-4110-A0F0-2E5228507FCD} = 194.204.159.1 194.204.152.34
TCP: {A3D50BEA-7E41-476C-89C3-356DDB0A12A0} = 192.168.2.2
FF - ProfilePath - c:\documents and settings\Marian\Dane aplikacji\Mozilla\Firefox\Profiles\53u4xly4.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - www.google.pl
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-09 18:39
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ...  

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...  

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'explorer.exe'(3616)
c:\windows\system32\msi.dll
.
Czas ukończenia: 2010-01-09  18:40:16
ComboFix-quarantined-files.txt  2010-01-09 17:40
ComboFix2.txt  2010-01-09 17:34

Przed: 64 571 445 248 bajtów wolnych
Po: 64 563 572 736 bajtów wolnych

- - End Of File - - 51BF8065AD455AD3E7C56D292CF07366
 System operacyjny: windows_xp_2003 Przeglądarka: firefox
#8
RE: wirus cvasds0.dll
Daj jeszcze log RSIT i Gmer.
 System operacyjny: windows_xp_2003 Przeglądarka: firefox
#9
RE: wirus cvasds0.dll
RSIT

Kod:
Logfile of random's system information tool 1.06 (written by random/random)
Run by Marian at 2010-01-10 17:42:58
Microsoft Windows XP Professional Dodatek Service Pack 2
System drive C: has 57 GB (75%) free of 76 GB
Total RAM: 3070 MB (79% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:43:02, on 2010-01-10
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\EXPERTool\TBPanel.exe
C:\Program Files\AutoConnect\AutoConnect.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Marian\Pulpit\Antywirusy i logi\RSIT.exe
C:\Program Files\trend micro\Marian.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=15458&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [BCU] "C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [GAINWARD] C:\Program Files\EXPERTool\TBPanel.exe /A
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{51E4FF40-042D-4110-A0F0-2E5228507FCD}: NameServer = 194.204.159.1 194.204.152.34
O17 - HKLM\System\CCS\Services\Tcpip\..\{A3D50BEA-7E41-476C-89C3-356DDB0A12A0}: NameServer = 192.168.2.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{51E4FF40-042D-4110-A0F0-2E5228507FCD}: NameServer = 194.204.159.1 194.204.152.34
O17 - HKLM\System\CS2\Services\Tcpip\..\{51E4FF40-042D-4110-A0F0-2E5228507FCD}: NameServer = 194.204.159.1 194.204.152.34
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Browser Configuration Utility Service (BCUService) - DeviceVM, Inc. - C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
O23 - Service: ES lite Service for program management. (ES lite Service) - Unknown owner - C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

--
End of file - 6548 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre6\bin\ssv.dll [2010-01-09 321312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-01-09 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-01-09 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"BCU"=C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe [2009-08-04 346320]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2009-06-25 17887232]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-06-10 86016]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-06-10 13758464]
"WOOWATCH"=C:\PROGRA~1\NEOSTR~1\Watch.exe [2004-08-23 20480]
"WOOTASKBARICON"=C:\PROGRA~1\NEOSTR~1\GestMaj.exe [2004-10-14 32768]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"GAINWARD"=C:\Program Files\EXPERTool\TBPanel.exe [2009-05-12 2181672]
"AutoConnect"=C:\Program Files\AutoConnect\AutoConnect.exe [2006-12-03 310784]
"Gadu-Gadu"=C:\Program Files\Gadu-Gadu\gg.exe [2007-01-16 1716224]
"AlcoholAutomount"=C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe [2009-04-24 203416]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre6\bin\jusched.exe [2010-01-09 149280]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\Sports Interactive\Football Manager 2010\fm.exe"="C:\Program Files\Sports Interactive\Football Manager 2010\fm.exe:*:Enabled:Football Manager 2010"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6d3ac6dc-fd53-11de-8799-4d6564696130}]
shell\AutoRun\command - H:\autorun.exe


======List of files/folders created in the last 1 months======

2010-01-10 16:29:43 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Sports Interactive
2010-01-10 16:29:18 ----D---- C:\Documents and Settings\Marian\Dane aplikacji\Sports Interactive
2010-01-10 16:16:13 ----HD---- C:\Program Files\Zero G Registry
2010-01-10 16:16:13 ----D---- C:\Program Files\Sports Interactive
2010-01-10 16:05:29 ----RSD---- C:\WINDOWS\assembly
2010-01-10 16:05:10 ----D---- C:\WINDOWS\Microsoft.NET
2010-01-10 15:47:29 ----D---- C:\Documents and Settings\Marian\Dane aplikacji\Ashampoo
2010-01-10 15:43:49 ----D---- C:\Program Files\Ashampoo
2010-01-10 15:42:37 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo
2010-01-09 20:18:47 ----SHD---- C:\RECYCLER
2010-01-09 20:15:57 ----D---- C:\Program Files\Alcohol Soft
2010-01-09 18:40:17 ----A---- C:\ComboFix.txt
2010-01-09 18:29:06 ----D---- C:\WINDOWS\Minidump
2010-01-09 18:26:00 ----A---- C:\Boot.bak
2010-01-09 18:25:55 ----RASHD---- C:\cmdcons
2010-01-09 18:25:29 ----A---- C:\WINDOWS\zip.exe
2010-01-09 18:25:29 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-01-09 18:25:29 ----A---- C:\WINDOWS\SWSC.exe
2010-01-09 18:25:29 ----A---- C:\WINDOWS\SWREG.exe
2010-01-09 18:25:29 ----A---- C:\WINDOWS\sed.exe
2010-01-09 18:25:29 ----A---- C:\WINDOWS\PEV.exe
2010-01-09 18:25:29 ----A---- C:\WINDOWS\NIRCMD.exe
2010-01-09 18:25:29 ----A---- C:\WINDOWS\MBR.exe
2010-01-09 18:25:29 ----A---- C:\WINDOWS\grep.exe
2010-01-09 18:25:15 ----D---- C:\WINDOWS\ERDNT
2010-01-09 18:22:56 ----D---- C:\Qoobox
2010-01-09 18:17:26 ----D---- C:\Documents and Settings\Marian\Dane aplikacji\WinRAR
2010-01-09 16:52:56 ----D---- C:\Program Files\a-squared Free
2010-01-09 16:36:50 ----D---- C:\Documents and Settings\Marian\Dane aplikacji\Malwarebytes
2010-01-09 16:36:45 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-01-09 16:36:45 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes
2010-01-09 16:10:20 ----D---- C:\Program Files\Eidos Interactive
2010-01-09 16:08:35 ----D---- C:\Program Files\Common Files\WhenU
2010-01-09 16:07:17 ----D---- C:\Program Files\DAEMON Tools SearchBar
2010-01-09 15:17:38 ----D---- C:\rsit
2010-01-09 15:17:38 ----D---- C:\Program Files\trend micro
2010-01-09 15:01:15 ----D---- C:\_OTL
2010-01-09 14:08:46 ----D---- C:\WINDOWS\system32\appmgmt
2010-01-09 14:01:54 ----D---- C:\Documents and Settings\Marian\Dane aplikacji\DAEMON Tools Lite
2010-01-09 12:08:12 ----D---- C:\Documents and Settings\Marian\Dane aplikacji\BitTorrent
2010-01-09 12:06:41 ----D---- C:\Program Files\BitTorrent
2010-01-09 11:58:40 ----D---- C:\Program Files\Microsoft Works
2010-01-09 11:58:29 ----D---- C:\Program Files\Microsoft Visual Studio
2010-01-09 11:58:29 ----D---- C:\Program Files\Common Files\DESIGNER
2010-01-09 11:56:48 ----D---- C:\WINDOWS\SHELLNEW
2010-01-09 11:56:32 ----D---- C:\Program Files\Microsoft Office
2010-01-09 11:56:31 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2010-01-09 11:55:51 ----RD---- C:\MSOCache
2010-01-09 11:00:22 ----D---- C:\HattrickOrganizer
2010-01-09 10:02:54 ----D---- C:\WINDOWS\system32\LogFiles
2010-01-09 01:37:49 ----D---- C:\Program Files\JDownloader
2010-01-09 01:25:45 ----D---- C:\WINDOWS\pss
2010-01-09 01:14:17 ----A---- C:\WINDOWS\system32\javaws.exe
2010-01-09 01:14:17 ----A---- C:\WINDOWS\system32\javaw.exe
2010-01-09 01:14:17 ----A---- C:\WINDOWS\system32\java.exe
2010-01-09 01:13:49 ----D---- C:\Program Files\Common Files\Java
2010-01-09 01:11:53 ----A---- C:\WINDOWS\system32\deploytk.dll
2010-01-09 01:09:58 ----D---- C:\Documents and Settings\Marian\Dane aplikacji\Sun
2010-01-09 01:05:01 ----D---- C:\Program Files\Media Player Classic
2010-01-09 01:05:01 ----A---- C:\WINDOWS\system32\rmoc3260.dll
2010-01-09 01:05:01 ----A---- C:\WINDOWS\system32\pndx5032.dll
2010-01-09 01:05:01 ----A---- C:\WINDOWS\system32\pndx5016.dll
2010-01-09 01:05:01 ----A---- C:\WINDOWS\system32\pncrt.dll
2010-01-09 01:05:00 ----D---- C:\Program Files\Real Alternative
2010-01-09 01:05:00 ----D---- C:\Documents and Settings\Marian\Dane aplikacji\Real
2010-01-09 01:05:00 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Real
2010-01-09 01:04:39 ----D---- C:\totalcmd
2010-01-09 01:04:39 ----A---- C:\WINDOWS\wincmd.ini
2010-01-09 01:04:12 ----D---- C:\Program Files\VSO
2010-01-09 01:03:48 ----D---- C:\Program Files\WinRAR
2010-01-09 01:03:29 ----D---- C:\Program Files\SLD Codec Pack
2010-01-09 01:03:07 ----D---- C:\Program Files\foobar2000
2010-01-09 01:01:22 ----D---- C:\Program Files\Gadu-Gadu
2010-01-09 01:00:53 ----D---- C:\Program Files\AutoConnect
2010-01-09 01:00:19 ----D---- C:\Documents and Settings\Marian\Dane aplikacji\Adobe
2010-01-09 00:53:54 ----D---- C:\Program Files\ALLPlayer
2010-01-09 00:49:12 ----A---- C:\WINDOWS\system32\MSVCR71.dll
2010-01-09 00:49:12 ----A---- C:\WINDOWS\system32\MSVCP71.dll
2010-01-09 00:49:12 ----A---- C:\WINDOWS\system32\MFC71.dll
2010-01-09 00:49:12 ----A---- C:\WINDOWS\system32\aswBoot.exe
2010-01-09 00:49:11 ----D---- C:\Program Files\Alwil Software
2010-01-09 00:45:39 ----D---- C:\Documents and Settings\Marian\Dane aplikacji\Mozilla
2010-01-09 00:45:35 ----D---- C:\Program Files\Mozilla Firefox
2010-01-09 00:39:10 ----A---- C:\WINDOWS\system32\WooDial2000.dll
2010-01-09 00:38:19 ----A---- C:\WINDOWS\Fast800.ini
2010-01-09 00:38:19 ----A---- C:\WINDOWS\adidsl.ini
2010-01-09 00:38:17 ----A---- C:\WINDOWS\system32\IPDETECT.EXE
2010-01-09 00:38:16 ----A---- C:\WINDOWS\system32\coclassfast.dll
2010-01-09 00:38:16 ----A---- C:\WINDOWS\system32\adadix32.dll
2010-01-09 00:38:16 ----A---- C:\WINDOWS\enddisk32.exe
2010-01-09 00:38:15 ----A---- C:\WINDOWS\system32\unaddrv.exe
2010-01-09 00:38:15 ----A---- C:\WINDOWS\system32\ADADIX2K.DLL
2010-01-09 00:38:15 ----A---- C:\WINDOWS\system32\ADADIX16.DLL
2010-01-09 00:38:11 ----D---- C:\Program Files\SAGEM
2010-01-09 00:37:48 ----D---- C:\WINDOWS\system32\AlertModule
2010-01-09 00:37:47 ----A---- C:\WINDOWS\system32\W32n50.dll
2010-01-09 00:37:43 ----A---- C:\WINDOWS\system32\IfHelper.dll
2010-01-09 00:37:43 ----A---- C:\WINDOWS\system32\FTRTSVC.exe
2010-01-09 00:37:28 ----N---- C:\WINDOWS\system32\ActPanel.dll
2010-01-09 00:37:28 ----D---- C:\Program Files\Java
2010-01-09 00:36:42 ----D---- C:\Program Files\neostrada tp
2010-01-09 00:36:17 ----D---- C:\Documents and Settings\Marian\Dane aplikacji\Macromedia
2010-01-09 00:36:14 ----SHD---- C:\WINDOWS\ftpcache
2010-01-09 00:21:38 ----A---- C:\WINDOWS\system32\h323log.txt
2010-01-09 00:20:03 ----A---- C:\WINDOWS\system32\hidserv.dll
2010-01-09 00:19:05 ----A---- C:\WINDOWS\system32\usbui.dll
2010-01-09 00:18:15 ----A---- C:\WINDOWS\imsins.BAK
2010-01-09 00:18:13 ----SHD---- C:\WINDOWS\Installer
2010-01-09 00:18:13 ----D---- C:\Program Files\Common Files\ODBC
2010-01-09 00:18:13 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-01-09 00:18:13 ----A---- C:\WINDOWS\ODBCINST.INI
2010-01-09 00:18:09 ----RD---- C:\Program Files
2010-01-09 00:18:09 ----D---- C:\Program Files\Common Files\SpeechEngines
2010-01-09 00:18:09 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-01-09 00:18:09 ----D---- C:\Program Files\Common Files
2010-01-09 00:18:05 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2010-01-09 00:18:05 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2010-01-09 00:18:05 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2010-01-09 00:18:02 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2010-01-09 00:18:02 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2010-01-09 00:18:02 ----RA---- C:\WINDOWS\system32\kbdur.dll
2010-01-09 00:18:02 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2010-01-09 00:18:02 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2010-01-09 00:18:02 ----RA---- C:\WINDOWS\system32\kbdru.dll
2010-01-09 00:18:02 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2010-01-09 00:18:02 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2010-01-09 00:18:02 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2010-01-09 00:18:02 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2010-01-09 00:18:02 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2010-01-09 00:18:02 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2010-01-09 00:17:59 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2010-01-09 00:17:59 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2010-01-09 00:17:59 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2010-01-09 00:17:59 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2010-01-09 00:17:59 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2010-01-09 00:17:59 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2010-01-09 00:17:59 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2010-01-09 00:17:57 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2010-01-09 00:17:57 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2010-01-09 00:17:57 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2010-01-09 00:17:57 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2010-01-09 00:17:57 ----RA---- C:\WINDOWS\system32\kbdest.dll
2010-01-09 00:17:53 ----A---- C:\WINDOWS\system32\kbdsl1.dll
2010-01-09 00:17:53 ----A---- C:\WINDOWS\system32\kbdsl.dll
2010-01-09 00:17:53 ----A---- C:\WINDOWS\system32\kbdro.dll
2010-01-09 00:17:53 ----A---- C:\WINDOWS\system32\kbdhu1.dll
2010-01-09 00:17:53 ----A---- C:\WINDOWS\system32\kbdhu.dll
2010-01-09 00:17:53 ----A---- C:\WINDOWS\system32\kbdcz2.dll
2010-01-09 00:17:53 ----A---- C:\WINDOWS\system32\kbdcz1.dll
2010-01-09 00:17:52 ----A---- C:\WINDOWS\system32\kbdycl.dll
2010-01-09 00:17:52 ----A---- C:\WINDOWS\system32\kbdcz.dll
2010-01-09 00:17:52 ----A---- C:\WINDOWS\system32\kbdcr.dll
2010-01-09 00:17:52 ----A---- C:\WINDOWS\system32\KBDAL.DLL
2010-01-09 00:17:51 ----A---- C:\WINDOWS\system32\spxcoins.dll
2010-01-09 00:17:51 ----A---- C:\WINDOWS\system32\irclass.dll
2010-01-09 00:17:51 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2010-01-09 00:17:51 ----A---- C:\WINDOWS\system32\dgsetup.dll
2010-01-09 00:17:51 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2010-01-09 00:17:49 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2010-01-09 00:17:49 ----A---- C:\WINDOWS\TASKMAN.EXE
2010-01-09 00:17:48 ----A---- C:\WINDOWS\system32\batt.dll
2010-01-09 00:17:48 ----A---- C:\WINDOWS\NOTEPAD.EXE
2010-01-09 00:17:47 ----A---- C:\WINDOWS\system32\storprop.dll
2010-01-09 00:17:41 ----ASH---- C:\Documents and Settings\All Users\Dane aplikacji\desktop.ini
2010-01-09 00:17:38 ----RA---- C:\WINDOWS\SET8.tmp
2010-01-09 00:17:35 ----RA---- C:\WINDOWS\SET4.tmp
2010-01-09 00:17:33 ----RA---- C:\WINDOWS\SET3.tmp
2010-01-09 00:17:29 ----D---- C:\WINDOWS\system32\CatRoot2
2010-01-09 00:17:29 ----D---- C:\WINDOWS\system32\CatRoot
2010-01-09 00:17:23 ----SD---- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft
2010-01-09 00:17:01 ----A---- C:\WINDOWS\setuplog.txt
2010-01-09 00:16:58 ----D---- C:\Documents and Settings
2010-01-09 00:16:07 ----RASH---- C:\boot.ini
2010-01-09 00:11:20 ----SHD---- C:\System Volume Information
2010-01-09 00:07:49 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-01-09 00:07:49 ----RSD---- C:\WINDOWS\Fonts
2010-01-09 00:07:49 ----RD---- C:\WINDOWS\Web
2010-01-09 00:07:49 ----HD---- C:\WINDOWS\inf
2010-01-09 00:07:49 ----D---- C:\WINDOWS\WinSxS
2010-01-09 00:07:49 ----D---- C:\WINDOWS\twain_32
2010-01-09 00:07:49 ----D---- C:\WINDOWS\Temp
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\wins
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\wbem
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\usmt
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\spool
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\ShellExt
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\Setup
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\ras
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\oobe
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\npp
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\mui
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\inetsrv
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\IME
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\icsxml
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\ias
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\export
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\drivers
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\dhcp
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\config
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\3com_dmi
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\3076
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\2052
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\1054
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\1045
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\1042
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\1041
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\1037
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\1033
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\1031
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\1028
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32\1025
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system32
2010-01-09 00:07:49 ----D---- C:\WINDOWS\system
2010-01-09 00:07:49 ----D---- C:\WINDOWS\security
2010-01-09 00:07:49 ----D---- C:\WINDOWS\Resources
2010-01-09 00:07:49 ----D---- C:\WINDOWS\repair
2010-01-09 00:07:49 ----D---- C:\WINDOWS\Provisioning
2010-01-09 00:07:49 ----D---- C:\WINDOWS\PeerNet
2010-01-09 00:07:49 ----D---- C:\WINDOWS\pchealth
2010-01-09 00:07:49 ----D---- C:\WINDOWS\mui
2010-01-09 00:07:49 ----D---- C:\WINDOWS\msapps
2010-01-09 00:07:49 ----D---- C:\WINDOWS\msagent
2010-01-09 00:07:49 ----D---- C:\WINDOWS\Media
2010-01-09 00:07:49 ----D---- C:\WINDOWS\java
2010-01-09 00:07:49 ----D---- C:\WINDOWS\ime
2010-01-09 00:07:49 ----D---- C:\WINDOWS\Help
2010-01-09 00:07:49 ----D---- C:\WINDOWS\ehome
2010-01-09 00:07:49 ----D---- C:\WINDOWS\Driver Cache
2010-01-09 00:07:49 ----D---- C:\WINDOWS\Debug
2010-01-09 00:07:49 ----D---- C:\WINDOWS\Cursors
2010-01-09 00:07:49 ----D---- C:\WINDOWS\Connection Wizard
2010-01-09 00:07:49 ----D---- C:\WINDOWS\Config
2010-01-09 00:07:49 ----D---- C:\WINDOWS\AppPatch
2010-01-09 00:07:49 ----D---- C:\WINDOWS\addins
2010-01-09 00:07:49 ----D---- C:\WINDOWS
2010-01-08 23:49:55 ----D---- C:\WINDOWS\system32\AGEIA
2010-01-08 23:49:55 ----D---- C:\Program Files\AGEIA Technologies
2010-01-08 23:49:44 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-01-08 23:49:08 ----N---- C:\WINDOWS\system32\spmsg.dll
2010-01-08 23:49:01 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2010-01-08 23:48:45 ----A---- C:\WINDOWS\system32\nvudisp.exe
2010-01-08 23:48:13 ----A---- C:\WINDOWS\system32\NVUNINST.EXE
2010-01-08 23:47:45 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
2010-01-08 23:47:45 ----A---- C:\WINDOWS\system32\d3dx10_41.dll
2010-01-08 23:47:45 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll
2010-01-08 23:47:44 ----A---- C:\WINDOWS\system32\XAudio2_4.dll
2010-01-08 23:47:44 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll
2010-01-08 23:47:44 ----A---- C:\WINDOWS\system32\xactengine3_4.dll
2010-01-08 23:47:44 ----A---- C:\WINDOWS\system32\X3DAudio1_6.dll
2010-01-08 23:47:43 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2010-01-08 23:47:43 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2010-01-08 23:47:43 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2010-01-08 23:47:43 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2010-01-08 23:47:43 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2010-01-08 23:47:43 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2010-01-08 23:47:42 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2010-01-08 23:47:42 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2010-01-08 23:47:42 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
2010-01-08 23:47:42 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2010-01-08 23:47:42 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2010-01-08 23:47:42 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2010-01-08 23:47:41 ----A---- C:\WINDOWS\system32\XAudio2_1.dll
2010-01-08 23:47:41 ----A---- C:\WINDOWS\system32\XAPOFX1_0.dll
2010-01-08 23:47:41 ----A---- C:\WINDOWS\system32\xactengine3_1.dll
2010-01-08 23:47:41 ----A---- C:\WINDOWS\system32\X3DAudio1_4.dll
2010-01-08 23:47:41 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2010-01-08 23:47:40 ----A---- C:\WINDOWS\system32\XAudio2_0.dll
2010-01-08 23:47:40 ----A---- C:\WINDOWS\system32\D3DX9_38.dll
2010-01-08 23:47:40 ----A---- C:\WINDOWS\system32\d3dx10_38.dll
2010-01-08 23:47:40 ----A---- C:\WINDOWS\system32\D3DCompiler_38.dll
2010-01-08 23:47:39 ----A---- C:\WINDOWS\system32\xactengine3_0.dll
2010-01-08 23:47:39 ----A---- C:\WINDOWS\system32\X3DAudio1_3.dll
2010-01-08 23:47:39 ----A---- C:\WINDOWS\system32\D3DX9_37.dll
2010-01-08 23:47:39 ----A---- C:\WINDOWS\system32\d3dx10_37.dll
2010-01-08 23:47:39 ----A---- C:\WINDOWS\system32\D3DCompiler_37.dll
2010-01-08 23:47:38 ----A---- C:\WINDOWS\system32\xactengine2_10.dll
2010-01-08 23:47:38 ----A---- C:\WINDOWS\system32\d3dx10_36.dll
2010-01-08 23:47:38 ----A---- C:\WINDOWS\system32\D3DCompiler_36.dll
2010-01-08 23:47:37 ----A---- C:\WINDOWS\system32\xactengine2_9.dll
2010-01-08 23:47:37 ----A---- C:\WINDOWS\system32\d3dx9_36.dll
2010-01-08 23:47:37 ----A---- C:\WINDOWS\system32\d3dx10_35.dll
2010-01-08 23:47:37 ----A---- C:\WINDOWS\system32\D3DCompiler_35.dll
2010-01-08 23:47:36 ----A---- C:\WINDOWS\system32\xactengine2_8.dll
2010-01-08 23:47:36 ----A---- C:\WINDOWS\system32\X3DAudio1_2.dll
2010-01-08 23:47:36 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2010-01-08 23:47:36 ----A---- C:\WINDOWS\system32\d3dx9_34.dll
2010-01-08 23:47:36 ----A---- C:\WINDOWS\system32\d3dx10_34.dll
2010-01-08 23:47:36 ----A---- C:\WINDOWS\system32\D3DCompiler_34.dll
2010-01-08 23:47:35 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2010-01-08 23:47:35 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2010-01-08 23:47:34 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2010-01-08 23:47:34 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2010-01-08 23:47:33 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2010-01-08 23:47:32 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2010-01-08 23:47:32 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2010-01-08 23:47:32 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
2010-01-08 23:47:31 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2010-01-08 23:47:31 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2010-01-08 23:47:31 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2010-01-08 23:47:31 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2010-01-08 23:47:31 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2010-01-08 23:47:31 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2010-01-08 23:47:30 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2010-01-08 23:47:30 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2010-01-08 23:47:30 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2010-01-08 23:47:30 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2010-01-08 23:47:30 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2010-01-08 23:47:30 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2010-01-08 23:47:29 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2010-01-08 23:47:29 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2010-01-08 23:47:29 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2010-01-08 23:47:29 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2010-01-08 23:47:28 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2010-01-08 23:47:27 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2010-01-08 23:46:31 ----D---- C:\WINDOWS\Logs
2010-01-08 23:46:15 ----D---- C:\Program Files\EXPERTool
2010-01-08 23:40:30 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2010-01-08 23:40:30 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Norton
2010-01-08 23:39:46 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\NortonInstaller
2010-01-08 23:39:05 ----D---- C:\WINDOWS\system32\Atheros_L1e
2010-01-08 23:38:35 ----D---- C:\WINDOWS\system32\Lang
2010-01-08 23:37:20 ----D---- C:\WINDOWS\system32\RTCOM
2010-01-08 23:37:18 ----A---- C:\WINDOWS\system32\ksuser.dll
2010-01-08 23:37:14 ----A---- C:\WINDOWS\vncutil.exe
2010-01-08 23:37:14 ----A---- C:\WINDOWS\SOUNDMAN.EXE
2010-01-08 23:37:13 ----A---- C:\WINDOWS\SkyTel.exe
2010-01-08 23:37:13 ----A---- C:\WINDOWS\RtlUpd.exe
2010-01-08 23:37:12 ----A---- C:\WINDOWS\system32\RtkCoInstXP.dll
2010-01-08 23:37:12 ----A---- C:\WINDOWS\RtkAudioService.exe
2010-01-08 23:37:10 ----A---- C:\WINDOWS\RTLCPL.EXE
2010-01-08 23:37:04 ----A---- C:\WINDOWS\RTHDCPL.EXE
2010-01-08 23:37:03 ----A---- C:\WINDOWS\MicCal.exe
2010-01-08 23:36:59 ----A---- C:\WINDOWS\ALCWZRD.EXE
2010-01-08 23:36:59 ----A---- C:\WINDOWS\ALCMTR.EXE
2010-01-08 23:36:57 ----D---- C:\Program Files\Realtek
2010-01-08 23:36:54 ----R---- C:\WINDOWS\RtlExUpd.dll
2010-01-08 23:36:33 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2010-01-08 23:36:32 ----HDC---- C:\WINDOWS\$NtUninstallKB888111WXPSP2$
2010-01-08 23:34:44 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-01-08 23:34:43 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-01-08 23:34:42 ----RA---- C:\WINDOWS\system32\CSVer.dll
2010-01-08 23:34:42 ----D---- C:\Program Files\Intel
2010-01-08 23:34:36 ----D---- C:\Intel
2010-01-08 23:34:13 ----HD---- C:\Program Files\DeviceVM
2010-01-08 23:33:53 ----HD---- C:\Program Files\InstallShield Installation Information
2010-01-08 23:33:53 ----D---- C:\Program Files\Gigabyte
2010-01-08 23:33:50 ----D---- C:\Program Files\Common Files\InstallShield
2010-01-08 23:32:38 ----RA---- C:\WINDOWS\GSetup.exe
2010-01-08 23:32:38 ----A---- C:\WINDOWS\GSetup.ini
2010-01-08 23:31:10 ----D---- C:\Documents and Settings\Marian\Dane aplikacji\Identities
2010-01-08 23:31:08 ----HD---- C:\Program Files\Uninstall Information
2010-01-08 23:31:05 ----ASH---- C:\Documents and Settings\Marian\Dane aplikacji\desktop.ini
2010-01-08 23:31:04 ----SD---- C:\Documents and Settings\Marian\Dane aplikacji\Microsoft
2010-01-08 23:30:27 ----D---- C:\WINDOWS\SoftwareDistribution
2010-01-08 23:30:26 ----SD---- C:\WINDOWS\system32\Microsoft
2010-01-08 23:30:26 ----D---- C:\WINDOWS\Prefetch
2010-01-08 23:30:25 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-01-08 23:27:35 ----D---- C:\WINDOWS\system32\xircom
2010-01-08 23:27:35 ----D---- C:\Program Files\xerox
2010-01-08 23:27:35 ----D---- C:\Program Files\microsoft frontpage
2010-01-08 23:27:22 ----A---- C:\WINDOWS\control.ini
2010-01-08 23:27:22 ----A---- C:\AUTOEXEC.BAT
2010-01-08 23:27:15 ----A---- C:\WINDOWS\OEWABLog.txt
2010-01-08 23:27:12 ----A---- C:\WINDOWS\system32\mapi32.dll
2010-01-08 23:26:33 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-01-08 23:26:33 ----RD---- C:\WINDOWS\Offline Web Pages
2010-01-08 23:26:33 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2010-01-08 23:26:29 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2010-01-08 23:26:25 ----HD---- C:\Program Files\WindowsUpdate
2010-01-08 23:26:22 ----D---- C:\Program Files\Usługi online
2010-01-08 23:26:00 ----D---- C:\WINDOWS\system32\DirectX
2010-01-08 23:25:33 ----A---- C:\WINDOWS\system32\atrace.dll
2010-01-08 23:25:31 ----A---- C:\WINDOWS\system32\desktop.ini
2010-01-08 23:25:31 ----A---- C:\WINDOWS\desktop.ini
2010-01-08 23:25:24 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2010-01-08 23:25:23 ----A---- C:\WINDOWS\system32\acctres.dll
2010-01-08 23:25:22 ----D---- C:\Program Files\Common Files\Services
2010-01-08 23:25:19 ----SD---- C:\WINDOWS\Tasks
2010-01-08 23:25:19 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2010-01-08 23:25:18 ----D---- C:\Program Files\Common Files\MSSoap
2010-01-08 23:25:14 ----D---- C:\WINDOWS\srchasst
2010-01-08 23:25:13 ----D---- C:\WINDOWS\system32\Macromed
2010-01-08 23:25:08 ----A---- C:\WINDOWS\system32\wuweb.dll
2010-01-08 23:25:08 ----A---- C:\WINDOWS\system32\wucltui.dll
2010-01-08 23:25:08 ----A---- C:\WINDOWS\system32\wuauserv.dll
2010-01-08 23:25:08 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2010-01-08 23:25:07 ----A---- C:\WINDOWS\system32\wups.dll
2010-01-08 23:25:07 ----A---- C:\WINDOWS\system32\wuaueng.dll
2010-01-08 23:25:07 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2010-01-08 23:25:06 ----N---- C:\WINDOWS\system32\wuauclt.exe
2010-01-08 23:25:06 ----A---- C:\WINDOWS\system32\wuapi.dll
2010-01-08 23:25:06 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2010-01-08 23:25:06 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2010-01-08 23:25:06 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2010-01-08 23:25:05 ----N---- C:\WINDOWS\system32\qmgr.dll
2010-01-08 23:25:00 ----D---- C:\Program Files\Movie Maker
2010-01-08 23:24:55 ----A---- C:\WINDOWS\system32\safrslv.dll
2010-01-08 23:24:55 ----A---- C:\WINDOWS\system32\safrdm.dll
2010-01-08 23:24:55 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2010-01-08 23:24:55 ----A---- C:\WINDOWS\system32\racpldlg.dll
2010-01-08 23:24:49 ----A---- C:\WINDOWS\system32\fltMc.exe
2010-01-08 23:24:49 ----A---- C:\WINDOWS\system32\fltlib.dll
2010-01-08 23:24:48 ----N---- C:\WINDOWS\system32\srsvc.dll
2010-01-08 23:24:48 ----D---- C:\WINDOWS\system32\Restore
2010-01-08 23:24:48 ----A---- C:\WINDOWS\system32\srrstr.dll
2010-01-08 23:24:48 ----A---- C:\WINDOWS\system32\srclient.dll
2010-01-08 23:24:47 ----A---- C:\WINDOWS\system32\ils.dll
2010-01-08 23:24:46 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2010-01-08 23:24:46 ----A---- C:\WINDOWS\system32\msconf.dll
2010-01-08 23:24:46 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2010-01-08 23:24:46 ----A---- C:\WINDOWS\system32\mnmdd.dll
2010-01-08 23:24:46 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2010-01-08 23:24:42 ----D---- C:\Program Files\NetMeeting
2010-01-08 23:24:42 ----A---- C:\WINDOWS\system32\msoert2.dll
2010-01-08 23:24:42 ----A---- C:\WINDOWS\system32\msoeacct.dll
2010-01-08 23:24:41 ----A---- C:\WINDOWS\system32\inetres.dll
2010-01-08 23:24:40 ----A---- C:\WINDOWS\system32\inetcomm.dll
2010-01-08 23:24:37 ----N---- C:\WINDOWS\system32\schedsvc.dll
2010-01-08 23:24:37 ----D---- C:\Program Files\Outlook Express
2010-01-08 23:24:37 ----A---- C:\WINDOWS\system32\mstinit.exe
2010-01-08 23:24:37 ----A---- C:\WINDOWS\system32\mstask.dll
2010-01-08 23:24:36 ----A---- C:\WINDOWS\system32\isign32.dll
2010-01-08 23:24:36 ----A---- C:\WINDOWS\system32\inetcfg.dll
2010-01-08 23:24:36 ----A---- C:\WINDOWS\system32\icwphbk.dll
2010-01-08 23:24:36 ----A---- C:\WINDOWS\system32\icwdial.dll
2010-01-08 23:24:27 ----D---- C:\Program Files\Common Files\System
2010-01-08 23:24:26 ----D---- C:\Program Files\Internet Explorer
2010-01-08 23:24:00 ----D---- C:\Program Files\ComPlus Applications
2010-01-08 23:23:58 ----A---- C:\WINDOWS\vbaddin.ini
2010-01-08 23:23:58 ----A---- C:\WINDOWS\vb.ini
2010-01-08 23:23:55 ----D---- C:\WINDOWS\Registration
2010-01-08 23:23:49 ----D---- C:\Program Files\Windows Media Player
2010-01-08 23:23:44 ----D---- C:\Program Files\Messenger
2010-01-08 23:23:39 ----D---- C:\Program Files\MSN Gaming Zone
2010-01-08 23:23:39 ----A---- C:\WINDOWS\system32\write.exe
2010-01-08 23:23:23 ----A---- C:\WINDOWS\system32\sndvol32.exe
2010-01-08 23:23:22 ----A---- C:\WINDOWS\system32\hticons.dll
2010-01-08 23:23:22 ----A---- C:\WINDOWS\system32\avwav.dll
2010-01-08 23:23:22 ----A---- C:\WINDOWS\system32\avtapi.dll
2010-01-08 23:23:22 ----A---- C:\WINDOWS\system32\avmeter.dll
2010-01-08 23:23:21 ----A---- C:\WINDOWS\system32\winchat.exe
2010-01-08 23:23:11 ----A---- C:\WINDOWS\system32\sol.exe
2010-01-08 23:23:11 ----A---- C:\WINDOWS\system32\getuname.dll
2010-01-08 23:23:11 ----A---- C:\WINDOWS\system32\charmap.exe
2010-01-08 23:23:11 ----A---- C:\WINDOWS\system32\calc.exe
2010-01-08 23:23:10 ----A---- C:\WINDOWS\system32\winmine.exe
2010-01-08 23:23:10 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2010-01-08 23:23:10 ----A---- C:\WINDOWS\system32\reset.exe
2010-01-08 23:23:10 ----A---- C:\WINDOWS\system32\mshearts.exe
2010-01-08 23:23:10 ----A---- C:\WINDOWS\system32\freecell.exe
2010-01-08 23:23:09 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2010-01-08 23:23:09 ----A---- C:\WINDOWS\system32\tslabels.ini
2010-01-08 23:23:09 ----A---- C:\WINDOWS\system32\tskill.exe
2010-01-08 23:23:09 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2010-01-08 23:23:09 ----A---- C:\WINDOWS\system32\tscon.exe
2010-01-08 23:23:09 ----A---- C:\WINDOWS\system32\shadow.exe
2010-01-08 23:23:09 ----A---- C:\WINDOWS\system32\rwinsta.exe
2010-01-08 23:23:09 ----A---- C:\WINDOWS\system32\regini.exe
2010-01-08 23:23:08 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2010-01-08 23:23:08 ----A---- C:\WINDOWS\system32\qwinsta.exe
2010-01-08 23:23:08 ----A---- C:\WINDOWS\system32\qappsrv.exe
2010-01-08 23:23:08 ----A---- C:\WINDOWS\system32\msg.exe
2010-01-08 23:23:08 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2010-01-08 23:23:08 ----A---- C:\WINDOWS\system32\logoff.exe
2010-01-08 23:23:08 ----A---- C:\WINDOWS\system32\cdmodem.dll
2010-01-08 23:23:07 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2010-01-08 23:23:07 ----A---- C:\WINDOWS\system32\mtxex.dll
2010-01-08 23:23:07 ----A---- C:\WINDOWS\system32\mtxdm.dll
2010-01-08 23:23:07 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2010-01-08 23:23:07 ----A---- C:\WINDOWS\system32\comaddin.dll
2010-01-08 23:23:06 ----A---- C:\WINDOWS\system32\stclient.dll
2010-01-08 23:23:06 ----A---- C:\WINDOWS\system32\comsnap.dll
2010-01-08 23:23:06 ----A---- C:\WINDOWS\system32\comrepl.dll
2010-01-08 23:22:59 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2010-01-08 23:22:58 ----A---- C:\WINDOWS\system32\accwiz.exe
2010-01-08 23:22:57 ----D---- C:\Program Files\Windows NT
2010-01-08 23:22:57 ----A---- C:\WINDOWS\system32\sndrec32.exe
2010-01-08 23:22:57 ----A---- C:\WINDOWS\system32\mplay32.exe
2010-01-08 23:22:57 ----A---- C:\WINDOWS\system32\hypertrm.dll
2010-01-08 23:22:56 ----A---- C:\WINDOWS\system32\spider.exe
2010-01-08 23:22:56 ----A---- C:\WINDOWS\system32\mspaint.exe
2010-01-08 23:22:56 ----A---- C:\WINDOWS\system32\clipbrd.exe
2010-01-08 23:22:55 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2010-01-08 23:22:55 ----A---- C:\WINDOWS\system32\remotepg.dll
2010-01-08 23:22:55 ----A---- C:\WINDOWS\system32\rdshost.exe
2010-01-08 23:22:55 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2010-01-08 23:22:55 ----A---- C:\WINDOWS\system32\mstscax.dll
2010-01-08 23:22:55 ----A---- C:\WINDOWS\system32\mstsc.exe
2010-01-08 23:22:54 ----N---- C:\WINDOWS\system32\termsrv.dll
2010-01-08 23:22:54 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2010-01-08 23:22:54 ----A---- C:\WINDOWS\system32\sessmgr.exe
2010-01-08 23:22:54 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2010-01-08 23:22:54 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2010-01-08 23:22:54 ----A---- C:\WINDOWS\system32\rdpclip.exe
2010-01-08 23:22:54 ----A---- C:\WINDOWS\system32\rdchost.dll
2010-01-08 23:22:53 ----A---- C:\WINDOWS\system32\qprocess.exe
2010-01-08 23:22:53 ----A---- C:\WINDOWS\system32\icaapi.dll
2010-01-08 23:22:53 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2010-01-08 23:22:52 ----D---- C:\WINDOWS\system32\MsDtc
2010-01-08 23:22:52 ----A---- C:\WINDOWS\system32\mtxoci.dll
2010-01-08 23:22:52 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2010-01-08 23:22:51 ----A---- C:\WINDOWS\system32\xolehlp.dll
2010-01-08 23:22:51 ----A---- C:\WINDOWS\system32\msdtctm.dll
2010-01-08 23:22:51 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2010-01-08 23:22:51 ----A---- C:\WINDOWS\system32\msdtclog.dll
2010-01-08 23:22:51 ----A---- C:\WINDOWS\system32\msdtc.exe
2010-01-08 23:22:50 ----D---- C:\WINDOWS\system32\Com
2010-01-08 23:22:50 ----A---- C:\WINDOWS\system32\colbact.dll
2010-01-08 23:22:49 ----A---- C:\WINDOWS\system32\clbcatex.dll
2010-01-08 23:22:49 ----A---- C:\WINDOWS\system32\catsrvut.dll
2010-01-08 23:22:49 ----A---- C:\WINDOWS\system32\catsrvps.dll
2010-01-08 23:22:49 ----A---- C:\WINDOWS\system32\catsrv.dll
2010-01-08 23:22:48 ----A---- C:\WINDOWS\system32\comuid.dll
2010-01-08 23:22:48 ----A---- C:\WINDOWS\system32\comsvcs.dll
2010-01-08 23:22:47 ----A---- C:\WINDOWS\system32\clbcatq.dll
2010-01-08 23:22:36 ----A---- C:\WINDOWS\system32\servdeps.dll
2010-01-08 23:22:36 ----A---- C:\WINDOWS\system32\mmfutil.dll
2010-01-08 23:22:35 ----A---- C:\WINDOWS\system32\licwmi.dll
2010-01-08 23:22:35 ----A---- C:\WINDOWS\system32\cmprops.dll

======List of files/folders modified in the last 1 months======

2010-01-09 18:39:44 ----A---- C:\WINDOWS\system.ini
2010-01-09 11:57:00 ----A---- C:\WINDOWS\win.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 intelppm;Sterownik procesora Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 40320]
R1 kbdhid;Sterownik klawiatury HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-11-25 94160]
R2 TBPanel;TBPanel; C:\WINDOWS\system32\drivers\TBPanel.sys [2007-03-16 12256]
R3 adiusbaw;USB ADSL WAN Adapter; C:\WINDOWS\system32\DRIVERS\adiusbaw.sys [2005-09-19 126489]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys []
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-18 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-06-25 5095936]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller; C:\WINDOWS\system32\DRIVERS\l1c51x86.sys [2009-07-27 44032]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-07-03 8087712]
R3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbstor;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S2 ADILOADER;General Purpose USB Driver (adildr.sys); C:\WINDOWS\System32\Drivers\adildr.sys [2004-03-02 50007]
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2009-06-25 1684736]
S3 avqg3lpv;avqg3lpv; C:\WINDOWS\system32\drivers\avqg3lpv.sys []
S3 Cardex;Cardex; \??\C:\WINDOWS\system32\drivers\TBPANEL.SYS []
S3 catchme;catchme; \??\C:\DOCUME~1\Marian\USTAWI~1\Temp\catchme.sys []
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2009-06-25 1389056]
S3 PCAMPR5;PCAMPR5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCAMPR5.SYS []
S3 PCANDIS5;PCANDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCANDIS5.SYS []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 a2free;a-squared Free Service; C:\Program Files\a-squared Free\a2service.exe [2009-10-01 1858144]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 BCUService;Browser Configuration Utility Service; C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-08-04 219360]
R2 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
R2 ES lite Service;ES lite Service for program management.; C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE [2009-03-02 68136]
R2 FTRTSVC;France Telecom Routing Table Service; C:\WINDOWS\System32\FTRTSVC.exe [2004-08-23 40960]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-01-09 153376]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-06-10 168004]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

GEMR

Kod:
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-10 18:04:10
Windows 5.1.2600 Dodatek Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\Marian\USTAWI~1\Temp\kgkoakod.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                         ZwClose [0xB469D6B8]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                         ZwCreateKey [0xB469D574]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                         ZwDeleteValueKey [0xB469DA52]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                         ZwDuplicateObject [0xB469D14C]
SSDT            spbo.sys                                                                                                      ZwEnumerateKey [0xB7EC5CA4]
SSDT            spbo.sys                                                                                                      ZwEnumerateValueKey [0xB7EC6032]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                         ZwOpenKey [0xB469D64E]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                         ZwOpenProcess [0xB469D08C]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                         ZwOpenThread [0xB469D0F0]
SSDT            spbo.sys                                                                                                      ZwQueryKey [0xB7EC610A]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                         ZwQueryValueKey [0xB469D76E]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                         ZwRestoreKey [0xB469D72E]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                         ZwSetValueKey [0xB469D8AE]

INT 0x62        ?                                                                                                             8A34CBF8
INT 0x63        ?                                                                                                             8A105F00
INT 0x82        ?                                                                                                             8A34CBF8
INT 0x83        ?                                                                                                             8A105F00
INT 0xA4        ?                                                                                                             8A105F00
INT 0xB4        ?                                                                                                             8A105F00

---- Kernel code sections - GMER 1.0.15 ----

?               spbo.sys                                                                                                      Nie można odnaleźć określonego pliku. !
.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                      section is writeable [0xB7272360, 0x3D46A5, 0xE8000020]
.text           USBPORT.SYS!DllUnload                                                                                         B722E62C 5 Bytes  JMP 8A1054E0
.text           avqg3lpv.SYS                                                                                                  B3375386 35 Bytes  [00, 00, 00, 00, 00, 00, 20, ...]
.text           avqg3lpv.SYS                                                                                                  B33753AA 24 Bytes  [00, 00, 00, 00, 00, 00, 00, ...]
.text           avqg3lpv.SYS                                                                                                  B33753C4 3 Bytes  [00, 70, 02] {ADD [EAX+0x2], DH}
.text           avqg3lpv.SYS                                                                                                  B33753C9 1 Byte  [2E]
.text           avqg3lpv.SYS                                                                                                  B33753C9 11 Bytes  [2E, 00, 00, 00, 5A, 02, 00, ...]
.text           ...                                                                                                          

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\a-squared Free\a2service.exe[592] kernel32.dll!CreateThread + 1A                             7C810849 4 Bytes  CALL 0045495D C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH)

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT             atapi.sys[HAL.dll!READ_PORT_UCHAR]                                                                            [B7EA8042] spbo.sys
IAT             atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT]                                                                    [B7EA813E] spbo.sys
IAT             atapi.sys[HAL.dll!READ_PORT_USHORT]                                                                           [B7EA80C0] spbo.sys
IAT             atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                                   [B7EA8800] spbo.sys
IAT             atapi.sys[HAL.dll!WRITE_PORT_UCHAR]                                                                           [B7EA86D6] spbo.sys
IAT             \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR]                                            [B7EB7E9C] spbo.sys
IAT             \SystemRoot\System32\Drivers\avqg3lpv.SYS[HAL.dll!KfAcquireSpinLock]                                          001C9C96
IAT             \SystemRoot\System32\Drivers\avqg3lpv.SYS[HAL.dll!READ_PORT_UCHAR]                                            C6168B00
IAT             \SystemRoot\System32\Drivers\avqg3lpv.SYS[HAL.dll!KeGetCurrentIrql]                                           001CB986
IAT             \SystemRoot\System32\Drivers\avqg3lpv.SYS[HAL.dll!KfRaiseIrql]                                                428A0A00
IAT             \SystemRoot\System32\Drivers\avqg3lpv.SYS[HAL.dll!KfLowerIrql]                                                BA86880C
IAT             \SystemRoot\System32\Drivers\avqg3lpv.SYS[HAL.dll!HalGetInterruptVector]                                      8B00001C
IAT             \SystemRoot\System32\Drivers\avqg3lpv.SYS[HAL.dll!HalTranslateBusAddress]                                     24A48DFA
IAT             \SystemRoot\System32\Drivers\avqg3lpv.SYS[HAL.dll!KeStallExecutionProcessor]                                  00000000
IAT             \SystemRoot\System32\Drivers\avqg3lpv.SYS[HAL.dll!KfReleaseSpinLock]                                          4B8BDF8B
IAT             \SystemRoot\System32\Drivers\avqg3lpv.SYS[HAL.dll!READ_PORT_BUFFER_USHORT]                                    8D3F0304
IAT             \SystemRoot\System32\Drivers\avqg3lpv.SYS[HAL.dll!READ_PORT_USHORT]                                           CB033043
IAT             \SystemRoot\System32\Drivers\avqg3lpv.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                   0673C13B
IAT             \SystemRoot\System32\Drivers\avqg3lpv.SYS[HAL.dll!WRITE_PORT_UCHAR]                                           C13B0003
IAT             \SystemRoot\System32\Drivers\avqg3lpv.SYS[WMILIB.SYS!WmiSystemControl]                                        75000E7B
IAT             \SystemRoot\System32\Drivers\avqg3lpv.SYS[WMILIB.SYS!WmiCompleteRequest]                                      0B7D80E3

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\WINDOWS\system32\services.exe[796] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW]  003C0002
IAT             C:\WINDOWS\system32\services.exe[796] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW]        003C0000

---- Devices - GMER 1.0.15 ----

Device                                                                                                                        8A34B1F8
Device                                                                                                                        Ntfs.sys (NT File System Driver/Microsoft Corporation)
Device                                                                                                                        8929A1F8
Device                                                                                                                        Udfs.SYS (UDF File System Driver/Microsoft Corporation)

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                      aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device          \Driver\usbuhci \Device\USBPDO-0                                                                              8A0FC1F8
Device          \Driver\dmio \Device\DmControl\DmIoDaemon                                                                     8A2DC1F8
Device          \Driver\dmio \Device\DmControl\DmConfig                                                                       8A2DC1F8
Device          \Driver\dmio \Device\DmControl\DmPnP                                                                          8A2DC1F8
Device          \Driver\dmio \Device\DmControl\DmInfo                                                                         8A2DC1F8
Device          \Driver\usbuhci \Device\USBPDO-1                                                                              8A0FC1F8
Device          \Driver\usbuhci \Device\USBPDO-2                                                                              8A0FC1F8
Device          \Driver\usbuhci \Device\USBPDO-3                                                                              8A0FC1F8
Device          \Driver\usbehci \Device\USBPDO-4                                                                              8A0CF1F8

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                     aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device          \Driver\Ftdisk \Device\HarddiskVolume1                                                                        8A34D1F8
Device          \Driver\Ftdisk \Device\HarddiskVolume2                                                                        8A34D1F8
Device          \Driver\Cdrom \Device\CdRom0                                                                                  8A0A41F8
Device          \Driver\Ftdisk \Device\HarddiskVolume3                                                                        8A34D1F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3                                                                   8A34C1F8
Device          \Driver\atapi \Device\Ide\IdePort0                                                                            8A34C1F8
Device          \Driver\atapi \Device\Ide\IdePort1                                                                            8A34C1F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e                                                                   8A34C1F8
Device          \Driver\PCI_PNP1616 \Device\00000073                                                                          spbo.sys
Device          \Driver\Cdrom \Device\CdRom3                                                                                  8A0A41F8
Device          \Driver\sptd \Device\983787866                                                                                spbo.sys
Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                       89DA6500
Device          \Driver\NetBT \Device\NetbiosSmb                                                                              89DA6500
Device          \Driver\NetBT \Device\NetBT_Tcpip_{A3D50BEA-7E41-476C-89C3-356DDB0A12A0}                                      89DA6500

AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                     aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                   aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device          \Driver\usbstor \Device\0000006a                                                                              89F76370
Device          \Driver\usbstor \Device\0000006b                                                                              89F76370
Device          \Driver\usbuhci \Device\USBFDO-0                                                                              8A0FC1F8
Device          \Driver\usbuhci \Device\USBFDO-1                                                                              8A0FC1F8
Device          \FileSystem\MRxSmb \Device\LanmanDatagramReceiver                                                             8A052500
Device          \Driver\usbuhci \Device\USBFDO-2                                                                              8A0FC1F8
Device                                                                                                                        8A052500
Device          \Driver\usbuhci \Device\USBFDO-3                                                                              8A0FC1F8
Device          \Driver\NetBT \Device\NetBT_Tcpip_{51E4FF40-042D-4110-A0F0-2E5228507FCD}                                      89DA6500
Device          \Driver\usbehci \Device\USBFDO-4                                                                              8A0CF1F8
Device          \Driver\Ftdisk \Device\FtControl                                                                              8A34D1F8
Device          \Driver\avqg3lpv \Device\Scsi\avqg3lpv1Port2Path0Target0Lun0                                                  8922D1F8
Device          \Driver\avqg3lpv \Device\Scsi\avqg3lpv1                                                                       8922D1F8
Device          \FileSystem\Cdfs \Cdfs                                                                                        8A051500

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                            771343423
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                            285507792
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                            2
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                              
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0                           C:\Program Files\Alcohol Soft\Alcohol 52\
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                           1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                        0x77 0x79 0x99 0xEA ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001                    
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0                  0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew               0x52 0xEF 0x56 0x15 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40              
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew        0x7C 0xF5 0x69 0x96 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                              
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                           0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                        0x4A 0x07 0xCA 0x5B ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)          
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                               0
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                            0x4A 0x07 0xCA 0x5B ...

---- EOF - GMER 1.0.15 ----
 System operacyjny: windows_xp_2003 Przeglądarka: firefox
#10
RE: wirus cvasds0.dll
Daj je w postaci załącznika lub na wklej.org
 System operacyjny: windows_xp_2003 Przeglądarka: firefox
Programy: Polecane / Nowe / Inne




Podobne wątki (wirus cvasds0.dll)
Wątek: Autor Odpowiedzi: Wyświetleń: Ostatni post
  Wirus Mobogenie.dll i nengenie.dll lolek321 3 4224 28.02.2014, 23:30
Ostatni post: broda99
  vindevinecdm.dll i vindevinecdmadapter.dll wirus? Pyrzo 3 3340 18.01.2014, 11:52
Ostatni post: tomon
  Wirus spowalniający komputer BitGuard.dll Nejter 3 13927 04.01.2014, 07:47
Ostatni post: Skitter

Skocz do:


Wybrane wątki (wirus cvasds0.dll)
Wątek: Autor Odpowiedzi: Wyświetleń: Ostatni post
  Włączanie się strony internetowej w raz ze startem systemu LifesGood 2 4551 16.12.2018 02:44
Ostatni post: LifesGood
  przy odpaleniu windowsa włacza sie strona z wirusem :( Wojt84 1 4814 15.12.2018 05:25
Ostatni post: Illidan
  Wirus ransomware dawid_v22 3 4725 14.12.2018 00:52
Ostatni post: Fix00ser
  Samoistne włączanie się przez 1s. wiersza poleceń po starcie systemu z przeglądarką mattur88 5 4588 13.12.2018 14:25
Ostatni post: morderca
  Proszę bardzo o pomoc z WIRUSEM szymoneku 3 4455 10.12.2018 09:24
Ostatni post: morderca
  Wirus który wraca mimo że jest "usuwany"? shadowalker 7 1391 03.12.2018 14:50
Ostatni post: morderca
  1 rdzeń procesora na 100% arnagorn 2 4279 03.12.2018 14:19
Ostatni post: Illidan
  komputer widzi błąd seba1946 1 4201 03.12.2018 08:06
Ostatni post: morderca
  Strona z reklamami przy starcie systemu Lary57 2 6196 01.12.2018 21:07
Ostatni post: Lary57
  Dostałem e-maila od kogoś, kto zainfekował mi pc. czy to możliwe? Kazioko 1 4122 01.12.2018 08:20
Ostatni post: morderca
  Chrome/Mozilla, wyskakujące reklamy, przekierowania. waple 6 4413 23.11.2018 19:30
Ostatni post: waple
  Problem z bezpieczeństwem IP problemzip 3 6529 20.11.2018 17:37
Ostatni post: wlisik
  Procesor - użycie CPU od 80 do 100% - wszystkie programy zamknięte-spowolniona praca. MIRZET 7 1269 20.11.2018 17:25
Ostatni post: wlisik
  pendrive wyswietla skróty zamiast plików halucyn15785416 8 4464 19.11.2018 18:46
Ostatni post: halucyn15785416
  Samoistne włączanie się strony z grami po starcie systemu. Jurassa 4 4352 18.11.2018 02:02
Ostatni post: Jurassa