Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-02-2014 Ran by xxx (administrator) on MS-D on 05-02-2014 16:26:50 Running from F:\ Microsoft Windows XP Dodatek Service Pack 2 (X86) OS Language: Polish Internet Explorer Version 6 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ATTENTION: If processes are not listed WMI should be repaired. ==================== Processes (Whitelisted) =================== ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SoundMAXPnP] - C:\Program Files\Analog Devices\Core\smax4pnp.exe [872448 2007-01-05] (Analog Devices, Inc.) HKLM\...\Run: [SoundMAX] - C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [729088 2006-07-13] (Analog Devices, Inc.) HKLM\...\Run: [QlbCtrl] - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [159744 2007-05-07] ( Hewlett-Packard Development Company, L.P.) HKLM\...\Run: [WOOWATCH] - C:\Program Files\Neostrada TP\Watch.exe [20480 2003-10-16] (France Télécom R&D) HKLM\...\Run: [WOOTASKBARICON] - C:\Program Files\Neostrada TP\TaskBarIcon.exe [53248 2003-10-16] (France Télécom R&D) HKLM\...\Run: [NeroFilterCheck] - C:\WINDOWS\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh) HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2004-02-12] (Hewlett-Packard Company) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.) HKLM\...\Winlogon: [Userinit] C:\WINDOWS\system32\userinit.exe,C:\Program Files\NbrCLiBd\xtqqeeyo.exe Winlogon\Notify\Antiwpa: C:\WINDOWS\system32\antiwpa.dll () Winlogon\Notify\WgaLogon: WgaLogon.dll [X] HKU\S-1-5-21-1644491937-2147091713-839522115-1004\...\Run: [H/PC Connection Agent] - C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE [376912 2003-09-01] (Microsoft Corporation) HKU\S-1-5-21-1644491937-2147091713-839522115-1004\...\Policies\Explorer: [NoDriveTypeAutoRun] 0xFF000000 HKU\S-1-5-21-1644491937-2147091713-839522115-1004\...\MountPoints2: D - D:\setupSNK.exe HKU\S-1-5-21-1644491937-2147091713-839522115-1004\...\MountPoints2: {13d27d98-63db-11e1-bf47-001a73ae4b01} - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL \RECYCLER\S-7-8-46-4257740867-8547071284-227317622-6721\ynjBNQlN.exe HKU\S-1-5-21-1644491937-2147091713-839522115-1004\...\MountPoints2: {41d29baa-26b8-11e3-8048-001a73ae4b01} - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL \RECYCLER\S-0-6-62-1205103830-1076225053-361133240-1517\DwVpOxJM.exe HKU\S-1-5-21-1644491937-2147091713-839522115-1004\...\MountPoints2: {5136b8ef-f1f0-11dd-b5ce-001a73ae4b01} - pook.com HKU\S-1-5-21-1644491937-2147091713-839522115-1004\...\MountPoints2: {7d90cf2d-ac41-11de-b796-001a73ae4b01} - F:\m9ma.exe HKU\S-1-5-21-1644491937-2147091713-839522115-1004\...\MountPoints2: {899376fa-52ab-11e3-805d-001a73ae4b01} - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL \RECYCLER\S-2-4-10-1886805623-4401758574-752238163-2365\vDMTctxL.exe HKU\S-1-5-21-1644491937-2147091713-839522115-1004\...\MountPoints2: {8a54db9e-3d50-11e2-bfe0-001a73ae4b01} - H:\iStudio.exe HKU\S-1-5-21-1644491937-2147091713-839522115-1004\...\MountPoints2: {9a37a206-f164-11dd-b5cb-001a73ae4b01} - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\ntldr.com j: HKU\S-1-5-21-1644491937-2147091713-839522115-1004\...\MountPoints2: {ca7787d6-05b1-11de-b607-001a73ae4b01} - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL KapEF.exe Startup: C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart\xtqqeeyo.exe (Avira GmbH) Startup: C:\Documents and Settings\xxx\Menu Start\Programy\Autostart\xtqqeeyo.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home SearchScopes: HKLM - DefaultScope value is missing. BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (My Global Search) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO: IplexToALLPlayer - {DF925EF3-7A87-44E4-9CAF-8D7B280BF616} - C:\Program Files\ALLPlayer\Iplex\IplexToALLPlayer.dll (ALLCinema Ltd.) BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) Toolbar: HKLM - My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (My Global Search) Toolbar: HKCU - &Adres - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation) Toolbar: HKCU - &Łącza - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation) Toolbar: HKCU - My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (My Global Search) DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation) Handler: mctp - {d7b95390-b1c5-11d0-b111-0080c712fe82} - C:\Program Files\Microsoft ActiveSync\aatp.dll (Microsoft Corporation) Winsock: Catalog5 04 c:\Program Files\Bonjour\mdnsNSP.dll [94208] (Apple Computer, Inc.) Hosts: 127.0.0.1 localhost FireFox: ======== FF ProfilePath: C:\Documents and Settings\xxx\Dane aplikacji\Mozilla\Firefox\Profiles\1ltcdqd0.default FF DefaultSearchEngine: Ask Search FF SearchEngineOrder.1: Ask Search FF SelectedSearchEngine: Ask Search FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll () FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @macromedia.com/FlashPlayer10 - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @real.com/nppl3260;version=6.0.11.2571 - C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprpjplug;version=6.0.12.1739 - C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF Plugin HKCU: @macromedia.com/FlashPlayer10 - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll No File FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np32dsw.dll (Adobe Systems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPMyGlSh.dll (My Global Search) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Extension: FoxTab - C:\Documents and Settings\xxx\Dane aplikacji\Mozilla\Firefox\Profiles\1ltcdqd0.default\Extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}.xpi [2011-05-12] FF HKLM\...\Firefox\Extensions: [jqs@sun.com] - C:\Program Files\Java\jre6\lib\deploy\jqs\ff FF Extension: Java Quick Starter - C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2010-05-30] ========================== Services (Whitelisted) ================= R2 JavaQuickStarterService; C:\Program Files\Java\jre6\bin\jqs.exe [153376 2010-07-17] (Sun Microsystems, Inc.) S4 KMService; C:\WINDOWS\system32\srvany.exe [8192 2012-09-20] () ==================== Drivers (Whitelisted) ==================== R1 AFS2K; C:\WINDOWS\system32\Drivers\AFS2K.sys [82380 2009-02-05] (Oak Technology Inc.) R3 BCM43XX; C:\WINDOWS\System32\DRIVERS\bcmwl5.sys [1391104 2012-02-29] (Broadcom Corporation) S3 HPZid412; C:\WINDOWS\System32\DRIVERS\HPZid412.sys [51088 2004-06-21] (HP) S3 HPZipr12; C:\WINDOWS\System32\DRIVERS\HPZipr12.sys [16496 2004-06-21] (HP) S3 HPZius12; C:\WINDOWS\System32\DRIVERS\HPZius12.sys [21744 2004-06-21] (HP) R1 prodrv06; C:\WINDOWS\System32\drivers\prodrv06.sys [51744 2003-09-06] (Protection Technology) R0 prohlp02; C:\WINDOWS\System32\drivers\prohlp02.sys [62656 2003-09-06] (Protection Technology) R0 prosync1; C:\WINDOWS\System32\drivers\prosync1.sys [6944 2003-09-06] (Protection Technology) R0 sfhlp01; C:\WINDOWS\System32\drivers\sfhlp01.sys [4832 2003-09-06] (Protection Technology) S3 wceusbsh; C:\WINDOWS\System32\DRIVERS\wceusbsh.sys [104064 2003-09-01] (Microsoft Corporation) U1 eabfiltr; S4 IntelIde; No ImagePath U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96256 2004-08-03] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-02-05 14:36 - 2014-02-05 14:39 - 00000000 ____D () C:\AdwCleaner 2014-02-05 14:34 - 2014-02-05 14:36 - 00000000 ____D () C:\Documents and Settings\xxx\Pulpit\RK_Quarantine 2014-02-05 12:00 - 2014-02-05 12:18 - 00000000 ____D () C:\UsbFix 2014-02-04 01:19 - 2014-02-05 16:26 - 00000000 ____D () C:\FRST 2014-02-04 00:02 - 2014-02-05 16:24 - 00010971 _____ () C:\WINDOWS\WindowsUpdate.log 2014-02-03 23:55 - 2014-02-03 23:55 - 00000000 ____D () C:\Program Files\CCleaner 2014-02-03 23:55 - 2014-02-03 23:55 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\CCleaner 2014-02-03 23:42 - 2014-02-03 23:42 - 00000000 _____ () C:\Documents and Settings\xxx\Pulpit\Nowy Dokument tekstowy.txt 2014-02-03 19:06 - 2014-02-03 19:06 - 00000000 ____D () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Mozilla 2014-02-03 19:06 - 2014-02-03 19:06 - 00000000 ____D () C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla 2014-02-03 18:33 - 2014-02-03 23:15 - 00000188 ___SH () C:\Documents and Settings\Administrator\ntuser.ini 2014-02-03 18:33 - 2014-02-03 18:33 - 00000000 ___RD () C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart 2014-02-03 18:33 - 2014-02-03 18:33 - 00000000 ___HD () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji 2014-02-03 18:33 - 2014-02-03 18:33 - 00000000 ____D () C:\Documents and Settings\Administrator 2014-02-03 18:33 - 2007-10-26 20:09 - 00000000 __RHD () C:\Documents and Settings\Administrator\Dane aplikacji 2014-02-03 18:33 - 2007-10-26 20:09 - 00000000 ___RD () C:\Documents and Settings\Administrator\Menu Start 2014-02-03 18:33 - 2007-10-26 20:09 - 00000000 ___HD () C:\Documents and Settings\Administrator\Ustawienia lokalne 2014-02-03 18:33 - 2007-10-26 20:09 - 00000000 ____D () C:\Documents and Settings\Administrator\Ulubione 2014-02-03 18:33 - 2007-10-26 20:09 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit 2014-02-03 18:33 - 2007-10-26 20:09 - 00000000 ____D () C:\Documents and Settings\Administrator\Moje dokumenty 2014-02-03 18:33 - 2007-10-26 19:26 - 00001599 _____ () C:\Documents and Settings\Administrator\Menu Start\Programy\Pomoc zdalna.lnk 2014-02-03 18:33 - 2007-10-26 19:26 - 00000792 _____ () C:\Documents and Settings\Administrator\Menu Start\Programy\Windows Media Player.lnk 2014-02-03 18:33 - 2007-10-26 19:26 - 00000000 ___SD () C:\Documents and Settings\Administrator\Ustawienia lokalne\Historia 2014-02-03 18:33 - 2007-10-26 19:26 - 00000000 ___RD () C:\Documents and Settings\Administrator\Menu Start\Programy\Akcesoria 2014-02-03 18:33 - 2007-10-26 19:26 - 00000000 ___RD () C:\Documents and Settings\Administrator\Menu Start\Programy 2014-02-03 18:33 - 2007-10-26 19:23 - 00000000 ___HD () C:\Documents and Settings\Administrator\Szablony 2014-02-02 22:46 - 2014-02-02 22:46 - 00000000 __SHD () C:\WINDOWS\CSC 2014-01-28 00:17 - 2007-08-24 10:03 - 00180224 _____ (Intel Corporation) C:\WINDOWS\system32\igfxres.dll ==================== One Month Modified Files and Folders ======= 2014-02-05 16:26 - 2014-02-04 01:19 - 00000000 ____D () C:\FRST 2014-02-05 16:26 - 2008-11-09 13:29 - 00000000 ____D () C:\Documents and Settings\xxx\Pulpit 2014-02-05 16:24 - 2014-02-04 00:02 - 00010971 _____ () C:\WINDOWS\WindowsUpdate.log 2014-02-05 16:24 - 2008-11-09 13:29 - 00000188 ___SH () C:\Documents and Settings\xxx\ntuser.ini 2014-02-05 14:39 - 2014-02-05 14:36 - 00000000 ____D () C:\AdwCleaner 2014-02-05 14:39 - 2008-11-09 13:29 - 00000000 ___RD () C:\Documents and Settings\xxx\Menu Start\Programy 2014-02-05 14:39 - 2008-11-09 13:29 - 00000000 ___HD () C:\Documents and Settings\xxx\Ustawienia lokalne\Dane aplikacji 2014-02-05 14:39 - 2008-11-09 13:29 - 00000000 ____D () C:\Documents and Settings\xxx 2014-02-05 14:39 - 2007-10-26 20:08 - 00000000 __RHD () C:\Documents and Settings\All Users\Dane aplikacji 2014-02-05 14:36 - 2014-02-05 14:34 - 00000000 ____D () C:\Documents and Settings\xxx\Pulpit\RK_Quarantine 2014-02-05 14:36 - 2008-11-09 13:29 - 00000000 ___RD () C:\Documents and Settings\xxx\Menu Start\Programy\Autostart 2014-02-05 14:36 - 2007-10-26 20:09 - 00000000 ___RD () C:\Documents and Settings\All Users\Menu Start\Programy\Autostart 2014-02-05 14:29 - 2013-04-02 18:21 - 95023320 ___CT () C:\Documents and Settings\All Users\Dane aplikacji\otgiwl.pad 2014-02-05 14:10 - 2007-10-26 21:07 - 00000211 __RSH () C:\boot.ini 2014-02-05 14:10 - 2001-10-30 13:00 - 00000487 _____ () C:\WINDOWS\win.ini 2014-02-05 14:10 - 2001-10-30 13:00 - 00000227 _____ () C:\WINDOWS\system.ini 2014-02-05 12:18 - 2014-02-05 12:00 - 00000000 ____D () C:\UsbFix 2014-02-04 00:36 - 2010-01-21 21:35 - 00000000 ____D () C:\WINDOWS\pss 2014-02-04 00:30 - 2007-10-26 19:24 - 00000000 ____D () C:\WINDOWS\system32\Restore 2014-02-04 00:18 - 2007-10-27 09:54 - 00002549 _____ () C:\Documents and Settings\All Users\Menu Start\Programy\Microsoft Excel.lnk 2014-02-04 00:03 - 2007-10-26 20:08 - 01442832 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2014-02-04 00:00 - 2012-11-28 08:53 - 00000930 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2014-02-03 23:57 - 2009-01-22 17:20 - 00000000 ____D () C:\Documents and Settings\xxx\Dane aplikacji\Media Player Classic 2014-02-03 23:57 - 2008-01-31 01:23 - 00000000 ____D () C:\Program Files\Winamp 2014-02-03 23:56 - 2008-03-02 16:13 - 00000000 ____D () C:\WINDOWS\Minidump 2014-02-03 23:55 - 2014-02-03 23:55 - 00000000 ____D () C:\Program Files\CCleaner 2014-02-03 23:55 - 2014-02-03 23:55 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\CCleaner 2014-02-03 23:55 - 2007-10-26 20:09 - 00000000 ___RD () C:\Documents and Settings\All Users\Menu Start\Programy 2014-02-03 23:42 - 2014-02-03 23:42 - 00000000 _____ () C:\Documents and Settings\xxx\Pulpit\Nowy Dokument tekstowy.txt 2014-02-03 23:15 - 2014-02-03 18:33 - 00000188 ___SH () C:\Documents and Settings\Administrator\ntuser.ini 2014-02-03 22:03 - 2008-07-19 18:38 - 00000000 ____D () C:\Program Files\Neostrada TP 2014-02-03 19:06 - 2014-02-03 19:06 - 00000000 ____D () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Mozilla 2014-02-03 19:06 - 2014-02-03 19:06 - 00000000 ____D () C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla 2014-02-03 18:33 - 2014-02-03 18:33 - 00000000 ___RD () C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart 2014-02-03 18:33 - 2014-02-03 18:33 - 00000000 ___HD () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji 2014-02-03 18:33 - 2014-02-03 18:33 - 00000000 ____D () C:\Documents and Settings\Administrator 2014-02-02 23:49 - 2007-10-26 19:26 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2014-02-02 22:46 - 2014-02-02 22:46 - 00000000 __SHD () C:\WINDOWS\CSC 2014-02-02 14:39 - 2001-10-30 13:00 - 00002228 _____ () C:\WINDOWS\system32\wpa.dbl 2014-01-31 16:39 - 2007-10-26 20:09 - 01025780 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2014-01-31 16:39 - 2001-10-30 13:00 - 00463910 _____ () C:\WINDOWS\system32\perfh015.dat 2014-01-31 16:39 - 2001-10-30 13:00 - 00081256 _____ () C:\WINDOWS\system32\perfc015.dat 2014-01-27 23:45 - 2010-02-11 19:02 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-01-14 18:52 - 2008-11-09 13:29 - 00000000 ___RD () C:\Documents and Settings\xxx\Moje dokumenty ==================== Bamital & volsnap Check ================= C:\WINDOWS\explorer.exe [2002-09-20 18:05] - [2007-06-13 14:23] - 1034752 ____A (Microsoft Corporation) 029a562e81bbee088c61d418bf408f44 C:\WINDOWS\system32\winlogon.exe [2002-09-20 18:05] - [2004-08-03 23:44] - 0504832 ____A (Microsoft Corporation) 0344407089b08548d4feba62bb0f32d0 C:\WINDOWS\system32\svchost.exe [2001-10-30 13:00] - [2004-08-03 23:44] - 0014336 ____A (Microsoft Corporation) ba98327e90022dbd6ee76490e0622e2e C:\WINDOWS\system32\services.exe [2001-10-30 13:00] - [2009-02-09 11:10] - 0111104 ____A (Microsoft Corporation) ed4e5391100287b9eabf8f2cf4b42235 C:\WINDOWS\system32\User32.dll [2002-09-20 18:04] - [2007-03-08 16:38] - 0579072 ____A (Microsoft Corporation) a37a4637f84f8dd771274eaf8d17fa65 C:\WINDOWS\system32\userinit.exe [2002-09-20 18:05] - [2004-08-03 23:44] - 0025088 ____A (Microsoft Corporation) bd768099b4c44aa631728cb74eb54396 C:\WINDOWS\system32\rpcss.dll [2002-09-20 18:04] - [2009-02-09 11:22] - 0399360 ____A (Microsoft Corporation) b5d78596effbeb82f3b86d9a002538e1 ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected. C:\WINDOWS\system32\Drivers\volsnap.sys [2001-10-30 13:00] - [2004-08-03 23:36] - 0052864 ___AC (Microsoft Corporation) ecd173739b8ec10a814cc18653df5a36 ==================== End Of Log ============================