GMER 1.0.15.15641 - http://www.gmer.net Rootkit scan 2011-11-27 13:09:31 Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 SAMSUNG_ rev.2AC1 Running: dvhdjk1p.exe; Driver: C:\DOCUME~1\Marta\USTAWI~1\Temp\pgddipob.sys ---- System - GMER 1.0.15 ---- SSDT dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) ZwAllocateVirtualMemory [0xF742F2C4] SSDT dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) ZwCreateThread [0xF74308F6] SSDT dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) ZwFreeVirtualMemory [0xF742F550] SSDT dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) ZwOpenSection [0xF742F0E2] SSDT dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) ZwQueueApcThread [0xF74309FE] SSDT dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) ZwSetContextThread [0xF7430A4A] SSDT CDD_HOST.sys (Universal Networks Chained Display Driver Host Module/Nanjing Universal Networks (U-NET) Co., LTD.) ZwSetSystemInformation [0xF76488B0] SSDT dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) ZwSystemDebugControl [0xF742EFF8] SSDT dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) ZwWriteVirtualMemory [0xF742F660] ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Ntfs \Ntfs spiderg3.sys (Dr.Web File System Monitor/Doctor Web, Ltd.) AttachedDevice \FileSystem\Ntfs \Ntfs ibmfilter.sys (IBM Rescue and Recovery filter driver/IBM) AttachedDevice \Driver\Tcpip \Device\Ip dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 TDKeybd.SYS (TopDomain Keybaord Driver for Windows 2000/Nanjing Universal Networks (U-NET) Co., LTD.) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 TDKeybd.SYS (TopDomain Keybaord Driver for Windows 2000/Nanjing Universal Networks (U-NET) Co., LTD.) AttachedDevice \Driver\Tcpip \Device\Tcp dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) AttachedDevice \Driver\Tcpip \Device\Udp dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) AttachedDevice \Driver\Tcpip \Device\RawIp dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) Device \FileSystem\Fastfat \Fat 9C76ED20 AttachedDevice \FileSystem\Fastfat \Fat spiderg3.sys (Dr.Web File System Monitor/Doctor Web, Ltd.) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xE8 0x89 0xD4 0x50 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x7D 0xCA 0x18 0x99 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xCD 0x60 0xC6 0x9B ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x27 0x1E 0x84 0x44 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xE8 0x89 0xD4 0x50 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x7D 0xCA 0x18 0x99 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xCD 0x60 0xC6 0x9B ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x27 0x1E 0x84 0x44 ... ---- Files - GMER 1.0.15 ---- File C:\WINDOWS\$NtUninstallKB46700$\3430974739 0 bytes File C:\WINDOWS\$NtUninstallKB46700$\3430974739\@ 2048 bytes File C:\WINDOWS\$NtUninstallKB46700$\3430974739\L 0 bytes File C:\WINDOWS\$NtUninstallKB46700$\3430974739\L\egjdenag 58880 bytes File C:\WINDOWS\$NtUninstallKB46700$\3430974739\loader.tlb 2632 bytes File C:\WINDOWS\$NtUninstallKB46700$\3430974739\U 0 bytes File C:\WINDOWS\$NtUninstallKB46700$\3430974739\U\@00000001 45968 bytes File C:\WINDOWS\$NtUninstallKB46700$\3430974739\U\@000000c0 3072 bytes File C:\WINDOWS\$NtUninstallKB46700$\3430974739\U\@000000cb 3072 bytes File C:\WINDOWS\$NtUninstallKB46700$\3430974739\U\@000000cf 1536 bytes File C:\WINDOWS\$NtUninstallKB46700$\3430974739\U\@80000000 23040 bytes File C:\WINDOWS\$NtUninstallKB46700$\3430974739\U\@800000c0 35840 bytes File C:\WINDOWS\$NtUninstallKB46700$\3430974739\U\@800000cb 23040 bytes File C:\WINDOWS\$NtUninstallKB46700$\3430974739\U\@800000cf 29184 bytes File C:\WINDOWS\$NtUninstallKB46700$\912627064 0 bytes File C:\RRbackups\Documents and Settings 0 bytes File C:\RRbackups\Documents and Settings\Administrator 0 bytes File C:\RRbackups\Documents and Settings\Administrator\Dane aplikacji 0 bytes File C:\RRbackups\Documents and Settings\Administrator\Dane aplikacji\Microsoft 0 bytes File C:\RRbackups\Documents and Settings\Administrator\Dane aplikacji\Microsoft\Protect 0 bytes File C:\RRbackups\Documents and Settings\Administrator\Dane aplikacji\Microsoft\Protect\CREDHIST 24 bytes File C:\RRbackups\Documents and Settings\Administrator\Dane aplikacji\Microsoft\Protect\S-1-5-21-1468779244-4240329691-897257327-500 0 bytes File C:\RRbackups\Documents and Settings\Administrator\Dane aplikacji\Microsoft\Protect\S-1-5-21-1468779244-4240329691-897257327-500\3ad3fda2-34cf-4514-be8c-57d1f4aa9122 388 bytes File C:\RRbackups\Documents and Settings\Administrator\Dane aplikacji\Microsoft\Protect\S-1-5-21-1468779244-4240329691-897257327-500\Preferred 24 bytes File C:\RRbackups\Documents and Settings\Administrator\Dane aplikacji\Microsoft\Protect\S-1-5-21-506298639-4092807775-489833573-500 0 bytes File C:\RRbackups\Documents and Settings\Administrator\Dane aplikacji\Microsoft\Protect\S-1-5-21-506298639-4092807775-489833573-500\63ae8c67-f9a6-4bf6-ac9b-4bdc2af0745e 388 bytes File C:\RRbackups\Documents and Settings\Administrator\Dane aplikacji\Microsoft\Protect\S-1-5-21-506298639-4092807775-489833573-500\Preferred 24 bytes File C:\RRbackups\Documents and Settings\Administrator\Dane aplikacji\Microsoft\SystemCertificates 0 bytes File C:\RRbackups\Documents and Settings\Administrator\Dane aplikacji\Microsoft\SystemCertificates\My 0 bytes File C:\RRbackups\Documents and Settings\Administrator\Dane aplikacji\Microsoft\SystemCertificates\My\Certificates 0 bytes File C:\RRbackups\Documents and Settings\Administrator\Dane aplikacji\Microsoft\SystemCertificates\My\CRLs 0 bytes File C:\RRbackups\Documents and Settings\Administrator\Dane aplikacji\Microsoft\SystemCertificates\My\CTLs 0 bytes File C:\RRbackups\Documents and Settings\All Users 0 bytes File C:\RRbackups\Documents and Settings\All Users\Dane aplikacji 0 bytes File C:\RRbackups\Documents and Settings\All Users\Dane aplikacji\Microsoft 0 bytes File C:\RRbackups\Documents and Settings\All Users\Dane aplikacji\Microsoft\Crypto 0 bytes File C:\RRbackups\Documents and Settings\All Users\Dane aplikacji\Microsoft\Crypto\RSA 0 bytes File C:\RRbackups\Documents and Settings\All Users\Dane aplikacji\Microsoft\Crypto\RSA\MachineKeys 0 bytes File C:\RRbackups\Documents and Settings\All Users\Dane aplikacji\Microsoft\Crypto\RSA\MachineKeys\62c81f11b5c239d03071d60276e3ad73_c4a99d0e-5c84-46ac-b36a-b404ef25b388 1279 bytes File C:\RRbackups\Documents and Settings\All Users\Dane aplikacji\Microsoft\Crypto\RSA\MachineKeys\8e0a1c5e054defaa895041108047805a_c4a99d0e-5c84-46ac-b36a-b404ef25b388 93 bytes File C:\RRbackups\Documents and Settings\All Users\Dane aplikacji\Microsoft\Crypto\RSA\S-1-5-18 0 bytes File C:\RRbackups\Documents and Settings\All Users\Dane aplikacji\Microsoft\Crypto\RSA\S-1-5-18\3b66a2f18fb5544fec674f7b9bc641f8_c4a99d0e-5c84-46ac-b36a-b404ef25b388 50 bytes File C:\RRbackups\Documents and Settings\All Users\Dane aplikacji\Microsoft\Crypto\RSA\S-1-5-18\42e7e898003fbdeb9585806ee1664b51_c4a99d0e-5c84-46ac-b36a-b404ef25b388 57 bytes File C:\RRbackups\Documents and Settings\All Users\Dane aplikacji\Microsoft\Crypto\RSA\S-1-5-18\6b29ae44e85efac3c72ff4d1865d73f1_c4a99d0e-5c84-46ac-b36a-b404ef25b388 53 bytes File C:\RRbackups\Documents and Settings\All Users\Dane aplikacji\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_c4a99d0e-5c84-46ac-b36a-b404ef25b388 47 bytes File C:\RRbackups\Documents and Settings\All Users\Dane aplikacji\Microsoft\Crypto\RSA\S-1-5-18\83aa4cc77f591dfc2374580bbd95f6ba_c4a99d0e-5c84-46ac-b36a-b404ef25b388 45 bytes File C:\RRbackups\Documents and Settings\All Users\Dane aplikacji\Microsoft\Crypto\RSA\S-1-5-18\8e0a1c5e054defaa895041108047805a_c4a99d0e-5c84-46ac-b36a-b404ef25b388 93 bytes File C:\RRbackups\Documents and Settings\All Users\Dane aplikacji\Microsoft\Crypto\RSA\S-1-5-18\8f71098770f72c7a67cd8f1151619865_c4a99d0e-5c84-46ac-b36a-b404ef25b388 54 bytes File C:\RRbackups\Documents and Settings\All Users\Dane aplikacji\Microsoft\Crypto\RSA\S-1-5-18\a3489d654a9a0c7507c9000ccac65b53_c4a99d0e-5c84-46ac-b36a-b404ef25b388 2531 bytes File C:\RRbackups\Documents and Settings\All Users\Dane aplikacji\Microsoft\Crypto\RSA\S-1-5-18\d42cc0c3858a58db2db37658219e6400_c4a99d0e-5c84-46ac-b36a-b404ef25b388 899 bytes File C:\RRbackups\Documents and Settings\Default User 0 bytes File C:\RRbackups\Documents and Settings\Default User\Dane aplikacji 0 bytes File C:\RRbackups\Documents and Settings\Default User\Dane aplikacji\Microsoft 0 bytes File C:\RRbackups\Documents and Settings\Default User\Dane aplikacji\Microsoft\Protect 0 bytes File C:\RRbackups\Documents and Settings\Default User\Dane aplikacji\Microsoft\Protect\CREDHIST 24 bytes File C:\RRbackups\Documents and Settings\Default User\Dane aplikacji\Microsoft\Protect\S-1-5-21-1468779244-4240329691-897257327-500 0 bytes File C:\RRbackups\Documents and Settings\Default User\Dane aplikacji\Microsoft\Protect\S-1-5-21-1468779244-4240329691-897257327-500\3ad3fda2-34cf-4514-be8c-57d1f4aa9122 388 bytes File C:\RRbackups\Documents and Settings\Default User\Dane aplikacji\Microsoft\Protect\S-1-5-21-1468779244-4240329691-897257327-500\Preferred 24 bytes File C:\RRbackups\Documents and Settings\Default User\Dane aplikacji\Microsoft\Protect\S-1-5-21-506298639-4092807775-489833573-500 0 bytes File C:\RRbackups\Documents and Settings\Default User\Dane aplikacji\Microsoft\Protect\S-1-5-21-506298639-4092807775-489833573-500\63ae8c67-f9a6-4bf6-ac9b-4bdc2af0745e 388 bytes File C:\RRbackups\Documents and Settings\Default User\Dane aplikacji\Microsoft\Protect\S-1-5-21-506298639-4092807775-489833573-500\Preferred 24 bytes File C:\RRbackups\Documents and Settings\Default User\Dane aplikacji\Microsoft\SystemCertificates 0 bytes File C:\RRbackups\Documents and Settings\Default User\Dane aplikacji\Microsoft\SystemCertificates\My 0 bytes File C:\RRbackups\Documents and Settings\Default User\Dane aplikacji\Microsoft\SystemCertificates\My\Certificates 0 bytes File C:\RRbackups\Documents and Settings\Default User\Dane aplikacji\Microsoft\SystemCertificates\My\CRLs 0 bytes File C:\RRbackups\Documents and Settings\Default User\Dane aplikacji\Microsoft\SystemCertificates\My\CTLs 0 bytes File C:\RRbackups\Documents and Settings\Gość 0 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji 0 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\Microsoft 0 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\Microsoft\Protect 0 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\Microsoft\Protect\CREDHIST 24 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\Microsoft\Protect\S-1-5-21-1468779244-4240329691-897257327-500 0 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\Microsoft\Protect\S-1-5-21-1468779244-4240329691-897257327-500\3ad3fda2-34cf-4514-be8c-57d1f4aa9122 388 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\Microsoft\Protect\S-1-5-21-1468779244-4240329691-897257327-500\Preferred 24 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-501 0 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-501\53a50a28-02d4-49da-ad90-86421344cc0a 388 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-501\Preferred 24 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\Microsoft\Protect\S-1-5-21-506298639-4092807775-489833573-500 0 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\Microsoft\Protect\S-1-5-21-506298639-4092807775-489833573-500\63ae8c67-f9a6-4bf6-ac9b-4bdc2af0745e 388 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\Microsoft\Protect\S-1-5-21-506298639-4092807775-489833573-500\Preferred 24 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\Microsoft\SystemCertificates 0 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\Microsoft\SystemCertificates\My 0 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\Microsoft\SystemCertificates\My\Certificates 0 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\Microsoft\SystemCertificates\My\CRLs 0 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\Microsoft\SystemCertificates\My\CTLs 0 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\ThinkVantage 0 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\ThinkVantage\Client Security 0 bytes File C:\RRbackups\Documents and Settings\Gość\Dane aplikacji\ThinkVantage\Client Security\hibernation.dat 4 bytes File C:\RRbackups\Documents and Settings\LocalService 0 bytes File C:\RRbackups\Documents and Settings\LocalService\Dane aplikacji 0 bytes File C:\RRbackups\Documents and Settings\LocalService\Dane aplikacji\Microsoft 0 bytes File C:\RRbackups\Documents and Settings\LocalService\Dane aplikacji\Microsoft\SystemCertificates 0 bytes File C:\RRbackups\Documents and Settings\LocalService\Dane aplikacji\Microsoft\SystemCertificates\My 0 bytes File C:\RRbackups\Documents and Settings\LocalService\Dane aplikacji\Microsoft\SystemCertificates\My\Certificates 0 bytes File C:\RRbackups\Documents and Settings\LocalService\Dane aplikacji\Microsoft\SystemCertificates\My\CRLs 0 bytes File C:\RRbackups\Documents and Settings\LocalService\Dane aplikacji\Microsoft\SystemCertificates\My\CTLs 0 bytes File C:\RRbackups\Documents and Settings\Marta 0 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji 0 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft 0 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Crypto 0 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Crypto\RSA 0 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Crypto\RSA\S-1-5-21-220993969-3265632603-3924391503-1005 0 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Crypto\RSA\S-1-5-21-220993969-3265632603-3924391503-1005\49997513c9a8ccfa485f06d4fb662915_c4a99d0e-5c84-46ac-b36a-b404ef25b388 77 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Crypto\RSA\S-1-5-21-220993969-3265632603-3924391503-1005\6b29ae44e85efac3c72ff4d1865d73f1_c4a99d0e-5c84-46ac-b36a-b404ef25b388 53 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Crypto\RSA\S-1-5-21-220993969-3265632603-3924391503-1005\83aa4cc77f591dfc2374580bbd95f6ba_c4a99d0e-5c84-46ac-b36a-b404ef25b388 45 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Crypto\RSA\S-1-5-21-220993969-3265632603-3924391503-1005\8e0a1c5e054defaa895041108047805a_c4a99d0e-5c84-46ac-b36a-b404ef25b388 93 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Crypto\RSA\S-1-5-21-220993969-3265632603-3924391503-1005\8f71098770f72c7a67cd8f1151619865_c4a99d0e-5c84-46ac-b36a-b404ef25b388 54 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Crypto\RSA\S-1-5-21-220993969-3265632603-3924391503-1005\c58705458992b35189583f03e21c2175_c4a99d0e-5c84-46ac-b36a-b404ef25b388 46 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect 0 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\CREDHIST 160 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-1468779244-4240329691-897257327-500 0 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-1468779244-4240329691-897257327-500\3ad3fda2-34cf-4514-be8c-57d1f4aa9122 388 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-1468779244-4240329691-897257327-500\Preferred 24 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-1005 0 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-1005\02b35fc4-815c-44ee-9eb0-4f9e79fb755f 388 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-1005\13ad1266-a27b-4919-acf7-b11de2b5e7b0 388 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-1005\176ca1de-6f6d-44e2-8e66-11f29bcac171 388 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-1005\1b79a650-1dcf-4d38-bae4-ce7682c710e6 388 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-1005\28b46826-5ab4-4351-9375-ec32cdaebae8 388 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-1005\351fce96-d75a-48c9-83a8-7a1d2af17d04 388 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-1005\5c65a9b3-69d2-410b-9aa9-4565da0953a4 388 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-1005\6f016850-d011-4d51-8415-98288496b5f0 388 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-1005\87337a0a-b6f0-46a2-a20e-0bc487f6f94f 388 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-1005\b8d93a49-eca8-418c-b152-9a7dff498fc9 388 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-1005\d5914009-bf09-4348-a65e-496f9d0d12b2 388 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-1005\e783854e-5791-45f2-95c8-27a0167a4320 388 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-1005\f4e9a66b-69ec-4ea6-986d-07cf345a6dfd 388 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-1005\fe274d06-d3a6-46fd-896f-592786a6aec0 388 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-220993969-3265632603-3924391503-1005\Preferred 24 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-506298639-4092807775-489833573-500 0 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-506298639-4092807775-489833573-500\63ae8c67-f9a6-4bf6-ac9b-4bdc2af0745e 388 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\Protect\S-1-5-21-506298639-4092807775-489833573-500\Preferred 24 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\SystemCertificates 0 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\SystemCertificates\My 0 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\SystemCertificates\My\Certificates 0 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\SystemCertificates\My\CRLs 0 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\Microsoft\SystemCertificates\My\CTLs 0 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\ThinkVantage 0 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\ThinkVantage\Client Security 0 bytes File C:\RRbackups\Documents and Settings\Marta\Dane aplikacji\ThinkVantage\Client Security\hibernation.dat 4 bytes File C:\RRbackups\Documents and Settings\NetworkService 0 bytes File C:\RRbackups\Documents and Settings\NetworkService\Dane aplikacji 0 bytes File C:\RRbackups\Documents and Settings\NetworkService\Dane aplikacji\Microsoft 0 bytes File C:\RRbackups\Documents and Settings\NetworkService\Dane aplikacji\Microsoft\SystemCertificates 0 bytes File C:\RRbackups\Documents and Settings\NetworkService\Dane aplikacji\Microsoft\SystemCertificates\My 0 bytes File C:\RRbackups\Documents and Settings\NetworkService\Dane aplikacji\Microsoft\SystemCertificates\My\Certificates 0 bytes File C:\RRbackups\Documents and Settings\NetworkService\Dane aplikacji\Microsoft\SystemCertificates\My\CRLs 0 bytes File C:\RRbackups\Documents and Settings\NetworkService\Dane aplikacji\Microsoft\SystemCertificates\My\CTLs 0 bytes File C:\RRbackups\hints.dat 8192 bytes File C:\RRbackups\regcerts.dat 8192 bytes File C:\RRbackups\SAM 36864 bytes File C:\RRbackups\system 7864320 bytes File C:\RRbackups\system.dat 12288 bytes File C:\RRbackups\tvt.txt 7696 bytes File C:\RRbackups\usersids.dat 22880 bytes ---- EOF - GMER 1.0.15 ----