Logi
- Kod: Zaznacz wszystko
Logfile of HijackThis v1.99.1
Scan saved at 12:37:12, on 06-03-28
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:/WINDOWS/SYSTEM/KERNEL32.DLL
C:/WINDOWS/SYSTEM/MSGSRV32.EXE
C:/WINDOWS/SYSTEM/MPREXE.EXE
C:/WINDOWS/SYSTEM/MSTASK.EXE
C:/WINDOWS/SYSTEM/mmtask.tsk
C:/WINDOWS/SYSTEM/ATI2EVXX.EXE
C:/WINDOWS/EXPLORER.EXE
E:/PROGRAM FILES/WINAMP/WINAMPA.EXE
C:/PROGRAM FILES/ATI TECHNOLOGIES/ATI CONTROL PANEL/ATIPTAXX.EXE
C:/WINDOWS/SYSTEM/DDHELP.EXE
C:/WINDOWS/SYSTEM/WBEM/WINMGMT.EXE
D:/PROGRAM FILES/OPERA/OPERA.EXE
C:/PROGRAM FILES/GADU-GADU/GG.EXE
E:/HIJACKTHIS/HIJACKTHIS.EXE
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:/PROGRAM FILES/ADOBE/ACROBAT 5.0/READER/ACTIVEX/ACROIEHELPER.OCX
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:/Program Files/Java/jre1.5.0_06/bin/ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:/WINDOWS/SYSTEM/MSDXM.OCX
O4 - HKLM/../Run: [sre] rundll32.exe sre.dll,Register
O4 - HKLM/../Run: [Startup] WinlogonStartup
O4 - HKLM/../Run: [WinampAgent] E:/Program Files/Winamp/winampa.exe
O4 - HKLM/../Run: [auto__hloader__key] C:/WINDOWS/SYSTEM/hloader_exe.exe
O4 - HKLM/../Run: [key2] C:/WINDOWS/SYSTEM/winlog.exe
O4 - HKLM/../Run: [AVKWCtl] C:/PROGRA~1/ANTIVI~1/AVKWCTL9.EXE
O4 - HKLM/../Run: [ATIPTA] C:/Program Files/ATI Technologies/ATI Control Panel/atiptaxx.exe
O4 - HKLM/../RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM/../RunServices: [ATIPOLL] ati2evxx.exe
O4 - HKLM/../RunServices: [ATISmart] C:/WINDOWS/SYSTEM/ati2s9ag.exe
O4 - HKCU/../Run: [Komunikator] D:/PROGRAM FILES/TLEN.PL/TLEN.EXE
O4 - HKCU/../Run: [auto__hloader__key] C:/WINDOWS/SYSTEM/hloader_exe.exe
O4 - HKCU/../Run: [key2] C:/WINDOWS/SYSTEM/winlog.exe
O8 - Extra context menu item: Download using FlashGet - C:/PROGRAM FILES/FLASHGET/jc_link.htm
O8 - Extra context menu item: Download All by FlashGet - C:/PROGRAM FILES/FLASHGET/jc_all.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:/WINDOWS/web/related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:/WINDOWS/web/related.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:/PROGRAM FILES/FLASHGET/FLASHGET.EXE (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:/PROGRAM FILES/FLASHGET/FLASHGET.EXE (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/PROGRAM FILES/JAVA/JRE1.5.0_06/BIN/SSV.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:/PROGRAM FILES/JAVA/JRE1.5.0_06/BIN/SSV.DLL
O12 - Plugin for .spop: C:/PROGRA~1/INTERN~1/Plugins/NPDocBox.dll
O15 - Trusted Zone: *.gateone.ath.cx
O15 - Trusted Zone: *.gateone.ath.cx (HKLM)
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - http://download.ewido.net/ewidoOnlineScan.cab
O17 - HKLM/System/CCS/Services/VxD/MSTCP: NameServer = 194.204.159.1,194.204.152.34
"Silent Runners.vbs", revision 44, http://www.silentrunners.org/
Operating System: Windows 98
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Komunikator" = "D:\PROGRAM FILES\TLEN.PL\TLEN.EXE" [file not found]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"WinampAgent" = "E:\Program Files\Winamp\winampa.exe" [null data]
"key2" = "C:\WINDOWS\SYSTEM\winlog.exe" [file not found]
"AVKWCtl" = "C:\PROGRA~1\ANTIVI~1\AVKWCTL9.EXE" [file not found]
"ATIPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\ {++}
"SchedulingAgent" = "mstask.exe" [MS]
"ATIPOLL" = "ati2evxx.exe" ["ATI Technologies Inc."]
"ATISmart" = "C:\WINDOWS\SYSTEM\ati2s9ag.exe" [" "]
HKLM\Software\Microsoft\Active Setup\Installed Components\
{44BBA840-CC51-11CF-AAFA-00AA00B6015C}.Restore\(Default) = "Microsoft Outlook Express 6"
\StubPath = "rundll32.exe advpack.dll,UserUnInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C}" [MS]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "D:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX" ["("]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\SYSTEM\NVSHELL.DLL" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\SYSTEM\NVSHELL.DLL" ["NVIDIA Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]
HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\PROGRAM FILES\WINRAR\rarext.dll" [null data]
Active Desktop and Wallpaper:
-----------------------------
Active Desktop is enabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\Dane aplikacji\Microsoft\Internet Explorer\Tapeta programu Internet Explorer.bmp"
WIN.INI & SYSTEM.INI launch points:
-----------------------------------
SYSTEM.INI
[boot]
"SCRNSAVE.EXE=D:\SCREEN~1\SKYROC~1\SKYROC~1.SCR" (Skyrocket.scr) [null data]
Enabled Scheduled Tasks:
------------------------
"Rozpoczęcie aplikacji dostrajania" -> launches: "walign" [MS]
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "C:\WINDOWS\SYSTEM\rnr20.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
00000000000#\PackedCatalogItem (contains) DLL [Company Name], (at) # range:
C:\WINDOWS\SYSTEM\mswsosp.dll [MS], 1
C:\WINDOWS\SYSTEM\msafd.dll [MS], 2 - 4
C:\WINDOWS\SYSTEM\rsvpsp.dll [MS], 5 - 6
Toolbars, Explorer Bars, Extensions:
------------------------------------
Toolbars
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{5AA06644-BC46-4220-A460-47A6EB47C96D}"
-> {HKLM...CLSID} = "NavExcel Toolbar"
\InProcServer32\(Default) = "C:\PROGRAM FILES\NAVEXCEL SEARCH TOOLBAR\NAVEXCELBAR.DLL" [file not found]
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "&FlashGet"
"Exec" = "C:\PROGRAM FILES\FLASHGET\FLASHGET.EXE" [file not found]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKLM...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL" ["Sun Microsystems, Inc."]
Miscellaneous IE Hijack Points
------------------------------
HKLM\Software\Microsoft\Internet Explorer\Version = (invalid data)
The Internet Explorer version cannot be found!
C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")
The contents of IERESET.INF cannot be reliably checked!
Added lines (compared with English-language version):
[Strings]: START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
[Strings]: MS_START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
Missing lines (compared with English-language version):
[Strings]: 2 lines
----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 14 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 13 seconds.
---------- (total run time: 45 seconds)
