prosze o sprawdzenie loga

**Posty:** 8079 · przez **kajtekjr** 01 Lip 2006, 14:03

Witam was! Mam problem z mozilla i podejrzewam ze to moze byc wirus.. Problem wyglada tak:

Z góry thx za pomoc :!:

Wrzucam loga z HJ:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 14:01:50, on 2006-07-01 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\htpatch.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\LOGI_MWX.EXE C:\WINDOWS\system32\RunDll32.exe C:\PROGRA~1\MYWEBS~1\bar\5.bin\mwsoemon.exe C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SpeedFan\speedfan.exe C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE C:\Program Files\MOBILedit!\medFramework.exe C:\Program Files\Tlen.pl\tlen.exe C:\Program Files\mozilla.org\Mozilla\mozilla.exe C:\Program Files\Avant Browser\avant.exe C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\Rar$EX00.454\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file) R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\5.bin\MWSSRCAS.DLL O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\5.bin\MWSSRCAS.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\5.bin\MWSBAR.DLL O2 - BHO: (no name) - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\5.bin\MWSBAR.DLL O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\5.bin\MWSBAR.DLL,S O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\5.bin\mwsoemon.exe O4 - HKLM\..\Run: [MSN Service Drivers] svchost.exe O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe O4 - HKLM\..\RunServices: [MSN Service Drivers] svchost.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\5.bin\mwsoemon.exe O4 - HKCU\..\Run: [MSN Service Drivers] svchost.exe O4 - HKCU\..\RunServices: [MSN Service Drivers] svchost.exe O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZN O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera - C:\Program Files\Avant Browser\AddAllToADBlackList.htm O8 - Extra context menu item: Dodaj do listy blokowanych reklam - C:\Program Files\Avant Browser\AddToADBlackList.htm O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony... - C:\Program Files\Avant Browser\OpenAllLinks.htm O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm O8 - Extra context menu item: Podświetl - C:\Program Files\Avant Browser\Highlight.htm O8 - Extra context menu item: RapidShare-Download - res://C:\Documents and Settings\Administrator\Pulpit\Nowy folder (2)\More RapidShare\more-rapid.exe/RsMenExt.html O8 - Extra context menu item: Szukaj - C:\Program Files\Avant Browser\Search.htm O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe O16 - DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} (GameDesire Roulette) - http://67.15.101.3/g_bin/pl/roulette_2_0_0_17.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.exe O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://67.15.101.3/g_bin/pl/boards_2_0_0_24.cab O16 - DPF: {4539348E-01D7-11D5-9A39-0080C8D85044} (GameDesire Slots 90th) - http://67.15.101.3/g_bin/pl/slots90_2_0_0_29.cab O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} (GameDesire Sea Battle) - http://67.15.101.3/g_bin/pl/navy_2_0_0_19.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {A6212120-01D4-11D5-9A39-0080C8D85044} (GameDesire Slots 70th) - http://67.15.101.3/g_bin/pl/slots70_2_0_0_26.cab O16 - DPF: {A7196C8E-35A5-4FF0-9E46-E28918B5CAF6} (GameDesire Domino) - http://67.15.101.3/g_bin/pl/domino_2_0_0_24.cab O16 - DPF: {ECEAD8AE-01D6-11D5-9A39-0080C8D85044} (GameDesire Slots 80th) - http://67.15.101.3/g_bin/pl/slots80_2_0_0_26.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{F861EC59-9164-4468-8FA6-FC61736E8094}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - D:\moje dok\Natalia\GG\s nowy\Spik\url_wpmsg.dll (file missing) O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

przez **jeff** 01 Lip 2006, 14:34

wszystkie czynności wykonujesz w trybie awaryjnym z wyłączonym przywracaniem systemu

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\5.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\5.bin\MWSSRCAS.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\5.bin\MWSBAR.DLL
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\5.bin\MWSBAR.DLL

O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\5.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\5.bin\mwsoemon.exe
O4 - HKLM\..\Run: [MSN Service Drivers] svchost.exe -> nie pomyl lokalizacji
O4 - HKLM\..\RunServices: [MSN Service Drivers] svchost.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\5.bin\mwsoemon.exe
O4 - HKCU\..\Run: [MSN Service Drivers] svchost.exe
O4 - HKCU\..\RunServices: [MSN Service Drivers] svchost.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZN
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBIniti alSetup1.0.0.15.exe
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

najpierw kasujesz wpisy w Hijacku, potem ręcznie pogrubione pliki/foldery. Po zabiegach nowy log

jeżeli nie masz GetRight`a to skasuj tez ten wpis

O2 - BHO: (no name) - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - (no file)

Autor postu otrzymał pochwałę

**Posty:** 8079 · przez **kajtekjr** 01 Lip 2006, 15:23

Log kontrolny z HJ:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:21:32, on 2006-07-01 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\htpatch.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\LOGI_MWX.EXE C:\WINDOWS\system32\RunDll32.exe C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SpeedFan\speedfan.exe C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\mozilla.org\Mozilla\mozilla.exe C:\Documents and Settings\Administrator\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSN Service Drivers] svchost.exe O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm O8 - Extra context menu item: RapidShare-Download - res://C:\Documents and Settings\Administrator\Pulpit\Nowy folder (2)\More RapidShare\more-rapid.exe/RsMenExt.html O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe O16 - DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} (GameDesire Roulette) - http://67.15.101.3/g_bin/pl/roulette_2_0_0_17.cab O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://67.15.101.3/g_bin/pl/boards_2_0_0_24.cab O16 - DPF: {4539348E-01D7-11D5-9A39-0080C8D85044} (GameDesire Slots 90th) - http://67.15.101.3/g_bin/pl/slots90_2_0_0_29.cab O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} (GameDesire Sea Battle) - http://67.15.101.3/g_bin/pl/navy_2_0_0_19.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {A6212120-01D4-11D5-9A39-0080C8D85044} (GameDesire Slots 70th) - http://67.15.101.3/g_bin/pl/slots70_2_0_0_26.cab O16 - DPF: {A7196C8E-35A5-4FF0-9E46-E28918B5CAF6} (GameDesire Domino) - http://67.15.101.3/g_bin/pl/domino_2_0_0_24.cab O16 - DPF: {ECEAD8AE-01D6-11D5-9A39-0080C8D85044} (GameDesire Slots 80th) - http://67.15.101.3/g_bin/pl/slots80_2_0_0_26.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{F861EC59-9164-4468-8FA6-FC61736E8094}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - D:\moje dok\Natalia\GG\s nowy\Spik\url_wpmsg.dll (file missing) O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

**Posty:** 8694 · przez **Red** 01 Lip 2006, 15:25

siedzi jeszcze :

O4 - HKCU\..\Run: [MSN Service Drivers] svchost.exe

prosze dolaczyc jeszcze jeden log:

otwierasz link>> http://www.silentrunners.org/Silent%20Runners.vbs >>zapisujesz jako na pulpicie>>klikasz dwa razy >>masz wybor i wybierasz no>>i czekasz troszke az wygeneruje sie cały log do konca
wrzucasz na forum

**Posty:** 8079 · przez **kajtekjr** 01 Lip 2006, 15:35

Log z SilentRunners

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 46, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "MSN Service Drivers" = "svchost.exe" [null data] "(Default)" = (empty string) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "HTpatch" = "C:\WINDOWS\htpatch.exe" [null data] "SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."] "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."] "DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "HP Software Update" = "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [null data] "HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" ["HP"] "DeviceDiscovery" = "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"] "DiskeeperSystray" = ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"" ["Diskeeper Corporation"] "Logitech Utility" = "LOGI_MWX.EXE" ["Logitech Inc."] "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] "DataLayer" = "C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" ["Nokia Mobile Phones Ltd."] "MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] {A5366673-E8CA-11D3-9CD9-0090271D075B}\(Default) = (no title provided) -> {HKLM...CLSID} = "IeCatch2 Class" \InProcServer32\(Default) = "C:\PROGRA~1\FLASHGET\jccatch.dll" ["Amaze Soft"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices" -> {HKLM...CLSID} = "Portable Media Devices" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" -> {HKLM...CLSID} = "Portable Media Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "D:\ALCOHO~2\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"] "{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band" -> {HKLM...CLSID} = "Shell Search Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS] "{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Folder przesyłania Share-to-Web" -> {HKLM...CLSID} = "Folder przesyłania Share-to-Web" \InProcServer32\(Default) = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"] "{0A082D00-EC93-11D0-B1E6-80580BC10627}" = "Corel Media Folder Root Menu Handler" -> {HKLM...CLSID} = "Corel Media Folder Root Menu Handler" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}" = "Folder To Corel Media Folder Menu Handler" -> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{854AF161-1AE1-11D1-AB9B-00C0F00683EB}" = "Corel Media Folder" -> {HKLM...CLSID} = "Corel Media Folder" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{E856F161-1AE5-11d1-AB9B-00C0F00683EB}" = "Corel Media Folder" -> {HKLM...CLSID} = "Corel Media Folder" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{CDB89701-262F-11D1-AB9C-00C0F00683EB}" = "Corel Media Find Folder" -> {HKLM...CLSID} = "Corel Media Find Folder" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{F8152501-455F-11D1-B1E6-444553540000}" = "Corel Media Folder Copy Hook Handler" -> {HKLM...CLSID} = "Corel Media Folder Copy Hook Handler" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{8E524B0D-04F0-11D1-B74A-00A0C90646A4}" = "IconFactTemp.NSIconHandlerFactory" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"] "{A2AC368A-F883-11D0-B745-00A0C90646A4}" = "NSFiltManDll.FiltManCom" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"] "{B63FCD5A-2396-11D1-B762-00A0C90646A4}" = "*n" (unwritable string) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFnd80.dll" ["Corel Corporation"] "{5E2121EE-0300-11D4-8D3B-444553540000}" = "Dodatki Spika" -> {HKLM...CLSID} = "SpikShellExt Class" \InProcServer32\(Default) = "D:\moje dok\Natalia\GG\Spik\shellext_wpmsg.dll" ["Wirtualna Polska S.A."] "{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser" -> {HKLM...CLSID} = "Nokia Phone Browser" \InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"] "{FBFE7864-D495-41f0-B7DC-4BB601CC295E}" = "Contact View" -> {HKLM...CLSID} = "Contact View" \InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\ContactView.dll" ["Nokia"] "{C0C4375A-5B72-4efe-929D-3B848C3A1E91}" = "Message View" -> {HKLM...CLSID} = "Message View" \InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll" ["Nokia"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] HKLM\System\CurrentControlSet\Control\Session Manager\ INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e" [file not found], [MS], [file not found], [file not found] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ Spik\(Default) = "{5E2121EE-0300-11D4-8D3B-444553540000}" -> {HKLM...CLSID} = "SpikShellExt Class" \InProcServer32\(Default) = "D:\moje dok\Natalia\GG\Spik\shellext_wpmsg.dll" ["Wirtualna Polska S.A."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WPKontakt\(Default) = "{5E2121EE-0300-11D4-8D3B-444553540000}" -> {HKLM...CLSID} = "SpikShellExt Class" \InProcServer32\(Default) = "D:\moje dok\Natalia\GG\Spik\shellext_wpmsg.dll" ["Wirtualna Polska S.A."] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ FolderToCorelMediaFolder\(Default) = "{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}" -> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Spik\(Default) = "{5E2121EE-0300-11D4-8D3B-444553540000}" -> {HKLM...CLSID} = "SpikShellExt Class" \InProcServer32\(Default) = "D:\moje dok\Natalia\GG\Spik\shellext_wpmsg.dll" ["Wirtualna Polska S.A."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "Administrator" & "All Users" startup folders: --------------------------------------------------------------- C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart "SpeedFan" -> shortcut to: "C:\Program Files\SpeedFan\speedfan.exe" ["Almico Software (www.almico.com)"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 18 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar" -> {HKLM...CLSID} = "FlashGet Bar" \InProcServer32\(Default) = "C:\PROGRA~1\FLASHGET\fgiebar.dll" ["Amaze Soft"] Explorer Bars Dormant Explorer Bars in "View, Explorer Bar" menu HKLM\Software\Classes\CLSID\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}\(Default) = "My Web Search Quick View" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_06" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."] {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "&FlashGet" "Exec" = "C:\PROGRA~1\FLASHGET\flashget.exe" ["Amaze Soft"] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Diskeeper, Diskeeper, ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe"" ["Diskeeper Corporation"] LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] NVIDIA Display Driver Service (Omega 1.6177) (Q), NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] StarWind iSCSI Service, StarWindService, "D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzsnt08\Driver = "hpzsnt08.dll" ["HP"] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 8 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 22 seconds. ---------- (total run time: 57 seconds)

**Posty:** 8694 · przez **Red** 01 Lip 2006, 15:39

otwierasz notatnik windowsa i wklejasz w nim to co ponizej:

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSN Service Drivers"=-

w notatniku u góry>>>plik zapisz jako>>>Zmienić rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisać pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

Restartujesz kompa i dajesz ponownie dwa logi do kontroli......dodatkowo przelec sysytem skanerem:
http://www.ewido.net/en/download/
i usun wszystko co znajdzie....

Autor postu otrzymał pochwałę

**Posty:** 8079 · przez **kajtekjr** 01 Lip 2006, 15:54

Log z HJ:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:49:37, on 2006-07-01 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\htpatch.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\LOGI_MWX.EXE C:\WINDOWS\system32\RunDll32.exe C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SpeedFan\speedfan.exe C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Administrator\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm O8 - Extra context menu item: RapidShare-Download - res://C:\Documents and Settings\Administrator\Pulpit\Nowy folder (2)\More RapidShare\more-rapid.exe/RsMenExt.html O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe O16 - DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} (GameDesire Roulette) - http://67.15.101.3/g_bin/pl/roulette_2_0_0_17.cab O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://67.15.101.3/g_bin/pl/boards_2_0_0_24.cab O16 - DPF: {4539348E-01D7-11D5-9A39-0080C8D85044} (GameDesire Slots 90th) - http://67.15.101.3/g_bin/pl/slots90_2_0_0_29.cab O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} (GameDesire Sea Battle) - http://67.15.101.3/g_bin/pl/navy_2_0_0_19.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {A6212120-01D4-11D5-9A39-0080C8D85044} (GameDesire Slots 70th) - http://67.15.101.3/g_bin/pl/slots70_2_0_0_26.cab O16 - DPF: {A7196C8E-35A5-4FF0-9E46-E28918B5CAF6} (GameDesire Domino) - http://67.15.101.3/g_bin/pl/domino_2_0_0_24.cab O16 - DPF: {ECEAD8AE-01D6-11D5-9A39-0080C8D85044} (GameDesire Slots 80th) - http://67.15.101.3/g_bin/pl/slots80_2_0_0_26.cab O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - D:\moje dok\Natalia\GG\s nowy\Spik\url_wpmsg.dll (file missing) O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

===============================================

:arrow:

Log z SilentRunners:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 46, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "(Default)" = (empty string) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "HTpatch" = "C:\WINDOWS\htpatch.exe" [null data] "SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."] "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."] "DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "HP Software Update" = "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [null data] "HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" ["HP"] "DeviceDiscovery" = "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"] "DiskeeperSystray" = ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"" ["Diskeeper Corporation"] "Logitech Utility" = "LOGI_MWX.EXE" ["Logitech Inc."] "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] "DataLayer" = "C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" ["Nokia Mobile Phones Ltd."] "MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] {A5366673-E8CA-11D3-9CD9-0090271D075B}\(Default) = (no title provided) -> {HKLM...CLSID} = "IeCatch2 Class" \InProcServer32\(Default) = "C:\PROGRA~1\FLASHGET\jccatch.dll" ["Amaze Soft"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices" -> {HKLM...CLSID} = "Portable Media Devices" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" -> {HKLM...CLSID} = "Portable Media Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "D:\ALCOHO~2\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"] "{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band" -> {HKLM...CLSID} = "Shell Search Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS] "{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Folder przesyłania Share-to-Web" -> {HKLM...CLSID} = "Folder przesyłania Share-to-Web" \InProcServer32\(Default) = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"] "{0A082D00-EC93-11D0-B1E6-80580BC10627}" = "Corel Media Folder Root Menu Handler" -> {HKLM...CLSID} = "Corel Media Folder Root Menu Handler" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}" = "Folder To Corel Media Folder Menu Handler" -> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{854AF161-1AE1-11D1-AB9B-00C0F00683EB}" = "Corel Media Folder" -> {HKLM...CLSID} = "Corel Media Folder" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{E856F161-1AE5-11d1-AB9B-00C0F00683EB}" = "Corel Media Folder" -> {HKLM...CLSID} = "Corel Media Folder" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{CDB89701-262F-11D1-AB9C-00C0F00683EB}" = "Corel Media Find Folder" -> {HKLM...CLSID} = "Corel Media Find Folder" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{F8152501-455F-11D1-B1E6-444553540000}" = "Corel Media Folder Copy Hook Handler" -> {HKLM...CLSID} = "Corel Media Folder Copy Hook Handler" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] "{8E524B0D-04F0-11D1-B74A-00A0C90646A4}" = "IconFactTemp.NSIconHandlerFactory" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"] "{A2AC368A-F883-11D0-B745-00A0C90646A4}" = "NSFiltManDll.FiltManCom" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"] "{B63FCD5A-2396-11D1-B762-00A0C90646A4}" = "*g" (unwritable string) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFnd80.dll" ["Corel Corporation"] "{5E2121EE-0300-11D4-8D3B-444553540000}" = "Dodatki Spika" -> {HKLM...CLSID} = "SpikShellExt Class" \InProcServer32\(Default) = "D:\moje dok\Natalia\GG\Spik\shellext_wpmsg.dll" ["Wirtualna Polska S.A."] "{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser" -> {HKLM...CLSID} = "Nokia Phone Browser" \InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"] "{FBFE7864-D495-41f0-B7DC-4BB601CC295E}" = "Contact View" -> {HKLM...CLSID} = "Contact View" \InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\ContactView.dll" ["Nokia"] "{C0C4375A-5B72-4efe-929D-3B848C3A1E91}" = "Message View" -> {HKLM...CLSID} = "Message View" \InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll" ["Nokia"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] HKLM\System\CurrentControlSet\Control\Session Manager\ INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e" [file not found], [MS], [file not found], [file not found] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ Spik\(Default) = "{5E2121EE-0300-11D4-8D3B-444553540000}" -> {HKLM...CLSID} = "SpikShellExt Class" \InProcServer32\(Default) = "D:\moje dok\Natalia\GG\Spik\shellext_wpmsg.dll" ["Wirtualna Polska S.A."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WPKontakt\(Default) = "{5E2121EE-0300-11D4-8D3B-444553540000}" -> {HKLM...CLSID} = "SpikShellExt Class" \InProcServer32\(Default) = "D:\moje dok\Natalia\GG\Spik\shellext_wpmsg.dll" ["Wirtualna Polska S.A."] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ FolderToCorelMediaFolder\(Default) = "{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}" -> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler" \InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Spik\(Default) = "{5E2121EE-0300-11D4-8D3B-444553540000}" -> {HKLM...CLSID} = "SpikShellExt Class" \InProcServer32\(Default) = "D:\moje dok\Natalia\GG\Spik\shellext_wpmsg.dll" ["Wirtualna Polska S.A."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "Administrator" & "All Users" startup folders: --------------------------------------------------------------- C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart "SpeedFan" -> shortcut to: "C:\Program Files\SpeedFan\speedfan.exe" ["Almico Software (www.almico.com)"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 18 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar" -> {HKLM...CLSID} = "FlashGet Bar" \InProcServer32\(Default) = "C:\PROGRA~1\FLASHGET\fgiebar.dll" ["Amaze Soft"] Explorer Bars Dormant Explorer Bars in "View, Explorer Bar" menu HKLM\Software\Classes\CLSID\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}\(Default) = "My Web Search Quick View" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_06" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."] {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "&FlashGet" "Exec" = "C:\PROGRA~1\FLASHGET\flashget.exe" ["Amaze Soft"] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Diskeeper, Diskeeper, ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe"" ["Diskeeper Corporation"] LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] NVIDIA Display Driver Service (Omega 1.6177) (Q), NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] StarWind iSCSI Service, StarWindService, "D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzsnt08\Driver = "hpzsnt08.dll" ["HP"] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 51 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 20 seconds. ---------- (total run time: 101 seconds)

**Posty:** 8694 · przez **Red** 01 Lip 2006, 16:00

logi są ok ,czyste .....ale jak tam komunikat???

**Posty:** 8079 · przez **kajtekjr** 01 Lip 2006, 16:08

Juz konczy skan.. Wrzuce sceena co znalazło..

**Posty:** 8694 · przez **Red** 01 Lip 2006, 16:09

Prosze bardzo ..........

**Posty:** 8079 · przez **kajtekjr** 01 Lip 2006, 16:28

Ten program znalazł cos takiego:

I jest w tym programie cos takiego jak jakis raport. tez to wklejam:

Kod: Zaznacz wszystko: --------------------------------------------------------- ewido anti-spyware - Scan Report --------------------------------------------------------- + Created at: 16:20:21 2006-07-01 + Scan result: C:\WINDOWS\temp.000.exe -> Adware.CashDeluxe : No action taken. C:\WINDOWS\GatorGainPlugin.log -> Adware.Claria : No action taken. C:\WINDOWS\Downloaded Program Files\CONFLICT.1\GainPlugin.dll -> Adware.Gator : No action taken. C:\WINDOWS\Downloaded Program Files\HDPlugin1101.dll -> Adware.Gator : No action taken. HKLM\SOFTWARE\Gator.com -> Adware.Gator : No action taken. HKLM\SOFTWARE\Gator.com\AppInfo -> Adware.Gator : No action taken. HKLM\SOFTWARE\Gator.com\CMEII -> Adware.Gator : No action taken. HKLM\SOFTWARE\Gator.com\Gator -> Adware.Gator : No action taken. HKLM\SOFTWARE\Gator.com\Gator\dyn -> Adware.Gator : No action taken. HKLM\SOFTWARE\Gator.com\Gator\dyn\GCH -> Adware.Gator : No action taken. HKLM\SOFTWARE\Gator.com\Gator\dyn\GCH\_gs -> Adware.Gator : No action taken. HKLM\SOFTWARE\Gator.com\trickles -> Adware.Gator : No action taken. HKLM\SOFTWARE\Gator.com\trickles\TRICKLER_6106 -> Adware.Gator : No action taken. HKLM\SOFTWARE\Gator.com\trickles\TRICKLER_6106\Trickler -> Adware.Gator : No action taken. HKLM\SOFTWARE\Gator.com\trickles\TRICKLER_6106\Trickler\trickle.gator.com:80/download/trickler6.cfg -> Adware.Gator : No action taken. HKLM\SOFTWARE\Gator.com\trickles\TRICKLER_6200 -> Adware.Gator : No action taken. HKLM\SOFTWARE\Gator.com\trickles\TRICKLER_6200\Trickler -> Adware.Gator : No action taken. HKLM\SOFTWARE\Gator.com\trickles\TRICKLER_6200\Trickler\trickle.gator.com:80/download/trickler6.cfg -> Adware.Gator : No action taken. C:\WINDOWS\NDNuninstall6_98.exe -> Adware.NewDotNet : No action taken. HKLM\SOFTWARE\Classes\WUSN.1 -> Adware.SaveNow : No action taken. HKLM\SOFTWARE\WhenU -> Adware.SaveNow : No action taken. C:\WINDOWS\svchost.exe -> Backdoor.Rbot : No action taken. C:\Documents and Settings\Administrator\Pulpit\Polyphonic_Wizard_4[1].02_by_fluid23.rar/Crack\CWPOLYWZ.EXE -> Backdoor.Small : No action taken. C:\Program Files\Coding Workshop Polyphonic Wizard\cwpolywz.exe -> Backdoor.Small : No action taken. C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.dll -> Logger.Agent.jo : No action taken. C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00002.dll -> Logger.Agent.jo : No action taken. C:\WINDOWS\kl.exe -> Logger.Small.dg : No action taken. C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\file\VerifierBug.class-488fe19e-200fc661.class -> Not-A-Virus.Exploit.Java.Bytverify : No action taken. C:\Documents and Settings\Administrator\Pulpit\Nero Burning ROM\cracksearcher.zip/cracksearcher/CrackSearcher.exe -> Not-A-Virus.HackTool.Win32.CrackSearch.a : No action taken. C:\Documents and Settings\Administrator\Pulpit\Nero Burning ROM\cracksearcher\cracksearcher\CrackSearcher.exe -> Not-A-Virus.HackTool.Win32.CrackSearch.a : No action taken. :mozilla.350:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.351:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.352:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.353:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.354:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.355:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.356:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. :mozilla.357:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@2o7[2].txt -> TrackingCookie.2o7 : No action taken. :mozilla.208:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.370:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.371:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.372:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.377:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.425:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adbrite : No action taken. :mozilla.265:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : No action taken. :mozilla.266:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : No action taken. :mozilla.451:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : No action taken. :mozilla.452:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : No action taken. :mozilla.509:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : No action taken. :mozilla.510:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : No action taken. :mozilla.76:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : No action taken. :mozilla.77:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@ad.adocean[2].txt -> TrackingCookie.Adocean : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@gde.adocean[2].txt -> TrackingCookie.Adocean : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@my.adocean[1].txt -> TrackingCookie.Adocean : No action taken. :mozilla.979:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adserver : No action taken. :mozilla.739:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adtech : No action taken. :mozilla.740:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adtech : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@adtech[1].txt -> TrackingCookie.Adtech : No action taken. :mozilla.542:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.543:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.544:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.545:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.546:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.547:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Advertising : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@advertising[1].txt -> TrackingCookie.Advertising : No action taken. :mozilla.723:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Atdmt : No action taken. :mozilla.865:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Bluestreak : No action taken. :mozilla.500:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Burstnet : No action taken. :mozilla.502:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Burstnet : No action taken. :mozilla.209:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Casalemedia : No action taken. :mozilla.210:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Casalemedia : No action taken. :mozilla.211:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Casalemedia : No action taken. :mozilla.212:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Casalemedia : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@casalemedia[1].txt -> TrackingCookie.Casalemedia : No action taken. :mozilla.360:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Clickhype : No action taken. :mozilla.361:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Clickhype : No action taken. :mozilla.482:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Com : No action taken. :mozilla.484:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Com : No action taken. :mozilla.235:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Doubleclick : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken. :mozilla.401:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Epilot : No action taken. :mozilla.490:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Euroclick : No action taken. :mozilla.491:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Euroclick : No action taken. :mozilla.568:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Falkag : No action taken. :mozilla.569:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Falkag : No action taken. :mozilla.570:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Falkag : No action taken. :mozilla.571:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Falkag : No action taken. :mozilla.572:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Falkag : No action taken. :mozilla.54:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.56:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.57:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.58:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. :mozilla.59:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Fastclick : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@fastclick[1].txt -> TrackingCookie.Fastclick : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@media.fastclick[2].txt -> TrackingCookie.Fastclick : No action taken. :mozilla.576:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Googleadservices : No action taken. :mozilla.626:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Googleadservices : No action taken. :mozilla.214:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.215:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.216:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.217:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.702:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.703:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.704:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.706:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.707:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.708:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.709:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.710:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.711:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.712:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.713:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.765:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.766:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.767:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.768:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.771:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : No action taken. :mozilla.659:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitslink : No action taken. :mozilla.660:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitslink : No action taken. :mozilla.661:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitslink : No action taken. :mozilla.662:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitslink : No action taken. :mozilla.245:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hotlog : No action taken. :mozilla.667:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hypertracker : No action taken. :mozilla.656:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Ivwbox : No action taken. :mozilla.692:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Mediaplex : No action taken. :mozilla.693:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Mediaplex : No action taken. :mozilla.744:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Onestat : No action taken. :mozilla.745:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Onestat : No action taken. :mozilla.539:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Overture : No action taken. :mozilla.540:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Overture : No action taken. :mozilla.541:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Overture : No action taken. :mozilla.874:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.875:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.876:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.877:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Pointroll : No action taken. :mozilla.695:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Popularix : No action taken. :mozilla.364:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Revenue : No action taken. :mozilla.436:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Ru4 : No action taken. :mozilla.437:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Ru4 : No action taken. :mozilla.817:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.cenzura-spam : No action taken. :mozilla.818:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.cenzura-spam : No action taken. :mozilla.255:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Sitestat : No action taken. :mozilla.256:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Sitestat : No action taken. :mozilla.246:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Spylog : No action taken. :mozilla.595:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.596:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.597:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.598:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.599:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.600:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : No action taken. :mozilla.601:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@statcounter[1].txt -> TrackingCookie.Statcounter : No action taken. :mozilla.284:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tacoda : No action taken. :mozilla.285:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tacoda : No action taken. :mozilla.286:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tacoda : No action taken. :mozilla.62:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.63:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.69:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.70:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.71:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.72:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.73:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.74:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.75:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : No action taken. :mozilla.643:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Trafic : No action taken. :mozilla.110:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tribalfusion : No action taken. C:\Documents and Settings\Administrator\Cookies\administrator@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : No action taken. :mozilla.738:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Valueclick : No action taken. :mozilla.964:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Weborama : No action taken. :mozilla.294:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Webtrendslive : No action taken. :mozilla.247:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yadro : No action taken. :mozilla.48:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.49:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.50:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.51:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.52:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.53:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.55:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : No action taken. :mozilla.683:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Zedo : No action taken. :mozilla.684:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Zedo : No action taken. :mozilla.685:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Zedo : No action taken. C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\file\BlackBox.class-4fbc14ee-7863e529.class -> Trojan.ClassLoader.c : No action taken. C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-393d648-23cb272c.class -> Trojan.ClassLoader.Dummy.d : No action taken. ::Report end

Jeszcze nic nie usuwałem..

**Posty:** 8694 · przez **Red** 01 Lip 2006, 16:31

to wszystko won >>>>zalacz opcje usuwania ,a nastepnie sciagnij :
http://siri.urz.free.fr/Fix/SmitfraudFix.php
masz opisane co i jak i daj log z opcji 1 na forum

**Posty:** 8079 · przez **kajtekjr** 01 Lip 2006, 16:35

Chyba o to chodziło:

Kod: Zaznacz wszystko: SmitFraudFix v2.65 Scan done at 16:33:22,15, 2006-07-01 Run from C:\Documents and Settings\Administrator\Pulpit\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT Fix ran in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS C:\WINDOWS\back.gif FOUND ! C:\WINDOWS\bg.gif FOUND ! C:\WINDOWS\download-btn.gif FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\ULUBIONE »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Moja bieľĄca strona gˆ˘wna" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

A w ewido anti-spyware wszystko skasowane

**Posty:** 8694 · przez **Red** 01 Lip 2006, 16:38

bardzo dobrze ze skasowane....

prosze jeszcze usunac to:

"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Moja bieľĄca strona gˆ˘wna"

usuniesz,uruchamiajac ten programik>>SmitFraudFix z opcji 2 i bedzie po wszystkim

Autor postu otrzymał pochwałę

**Posty:** 8079 · przez **kajtekjr** 01 Lip 2006, 16:42

Wrzuce jeszcze loga ktory wyskoczyl po uzyciu opcji 2 w SmitFraudFix:

Kod: Zaznacz wszystko: SmitFraudFix v2.65 Scan done at 16:39:54,89, 2006-07-01 Run from C:\Documents and Settings\Administrator\Pulpit\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT Fix ran in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

**Posty:** 8694 · przez **Red** 01 Lip 2006, 16:43

Wszystko juz jest ok ,poleciało to co miało polecieć

**Posty:** 8079 · przez **kajtekjr** 01 Lip 2006, 16:45

Jestes wielki Red :!:

Wielkie THX

prosze o sprawdzenie loga

prosze o sprawdzenie loga

Kto jest na forum