kolejny log do sprawdzenia...

**Posty:** 214 · przez **muzzy17** 02 Paź 2006, 19:54

mówiłem ze usunąłem killboxem plik mysvcc.exe

[ Dodano: Dzisiaj o 19:55 ]
internal.exe usunąłem ręcznie

**Posty:** 8694 · przez **Red** 02 Paź 2006, 20:04

Jednak w logu go widziałem ,daj najnowszy

**Posty:** 214 · przez **muzzy17** 02 Paź 2006, 20:12

to własnie jest najnowszy

**Posty:** 8694 · przez **Red** 02 Paź 2006, 20:13

muzzy17 napisał(a):O4 - HKLM\..\RunServices: [Microsoft explorer Update] internal.exe

to jest widok z najnowszego ,wiec siedzi nadal

**Posty:** 214 · przez **muzzy17** 02 Paź 2006, 20:18

w katalogu system32 go nie ma
ani przez start>wyszukaj nie mozna go znaleść ...

**Posty:** 8694 · przez **Red** 02 Paź 2006, 20:19

sciagnij:
http://www.bleepingcomputer.com/files/steelwerx/regsearch.zip

i daj mu na wyszukanie >>>internal.exe

**Posty:** 214 · przez **muzzy17** 02 Paź 2006, 20:25

Kod: Zaznacz wszystko: REGEDIT4 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.1.0 ; Results at 2006-10-02 20:07:30 for strings: ; 'internal.exe' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Microsoft explorer Update] "command"="internal.exe" [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Microsoft explorer Update"="internal.exe" [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Microsoft explorer Update"="internal.exe" [HKEY_USERS\S-1-5-21-1390067357-879983540-839522115-500\Software\Microsoft\Search Assistant\ACMru\5603] "000"="internal.exe" [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run] "Microsoft explorer Update"="internal.exe" [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Microsoft explorer Update"="internal.exe" ; End Of The Log...

**Posty:** 8694 · przez **Red** 02 Paź 2006, 20:36

pełny fix:

otwierasz notatnik windowsa i wklejasz w nim to co ponizej:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Microsoft explorer Update]
"command"=-

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft explorer Update"=-

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Microsoft explorer Update"=-

[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft explorer Update"=-

[HKEY_USERS\S-1-5-21-1390067357-879983540-839522115-500\Software\Microsoft\Search Assistant\ACMru\5603]
"000"=-

[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Microsoft explorer Update"=-

w notatniku u góry>>>plik zapisz jako>>>Zmienić rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisać pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

i raz jeszcze log do kontroli

**Posty:** 214 · przez **muzzy17** 02 Paź 2006, 20:45

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:27:03, on 2006-10-02 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe D:\Programy\AntiVir 6\AVWUPSRV.EXE D:\programy\ewido anti-spyware 4.0\guard.exe D:\Programy\ewido anti-spyware 4.0\ewido.exe D:\programy\AutoConnect\AutoConnect.exe C:\WINDOWS\System32\mysvcc.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\gry\FIFA 07\fifa07.exe D:\Ściągnięte\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [!ewido] "D:\Programy\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [AutoConnect] D:\programy\AutoConnect\AutoConnect.exe O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{485AC8C5-7429-404E-A3D3-243A8CF2C095}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\Programy\AntiVir 6\AVGUARD.EXE O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\Programy\AntiVir 6\AVWUPSRV.EXE O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\programy\ewido anti-spyware 4.0\guard.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\System32\nvsvc32.exe (file missing)

**Posty:** 8694 · przez **Red** 02 Paź 2006, 20:47

a tu jeszcze prosze:

C:\WINDOWS\System32\mysvcc.exe

prosze dac na wyszukiwanie >>>mysvcc.exe

internal.exe>>juz popłynął

**Posty:** 214 · przez **muzzy17** 02 Paź 2006, 20:52

Kod: Zaznacz wszystko: REGEDIT4 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.1.0 ; Results at 2006-10-02 20:33:48 for strings: ; 'mysvcc.exe ' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_USERS\S-1-5-21-1390067357-879983540-839522115-500\Software\Microsoft\Search Assistant\ACMru\5603] "003"="mysvcc.exe " ; End Of The Log...

**Posty:** 8694 · przez **Red** 02 Paź 2006, 21:03

otwierasz notatnik windowsa i wklejasz w nim to co ponizej:

Windows Registry Editor Version 5.00

[HKEY_USERS\S-1-5-21-1390067357-879983540-839522115-500\Software\Microsoft\Search Assistant\ACMru\5603]
"003"=-

w notatniku u góry>>>plik zapisz jako>>>Zmienić rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisać pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

**Posty:** 214 · przez **muzzy17** 02 Paź 2006, 21:07

zrobiłem to co kazałeś ale wg. hijackthis ten plik dalej jest ...

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:49:44, on 2006-10-02 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe D:\Programy\AntiVir 6\AVWUPSRV.EXE D:\programy\ewido anti-spyware 4.0\guard.exe D:\Programy\ewido anti-spyware 4.0\ewido.exe D:\programy\AutoConnect\AutoConnect.exe C:\WINDOWS\System32\mysvcc.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Ściągnięte\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [!ewido] "D:\Programy\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [AutoConnect] D:\programy\AutoConnect\AutoConnect.exe O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{485AC8C5-7429-404E-A3D3-243A8CF2C095}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\Programy\AntiVir 6\AVGUARD.EXE O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\Programy\AntiVir 6\AVWUPSRV.EXE O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\programy\ewido anti-spyware 4.0\guard.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\System32\nvsvc32.exe (file missing)

[ Dodano: Dzisiaj o 21:09 ]

Kod: Zaznacz wszystko: REGEDIT4 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.1.0 ; Results at 2006-10-02 20:50:57 for strings: ; 'mysvcc.exe' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\mysvcig38] "command"="mysvcc.exe" ; End Of The Log...

**Posty:** 8694 · przez **Red** 02 Paź 2006, 21:10

zastosuj:

http://www.firewallleaktester.com/tools/wwdc.exe
pozamykaj porty:
http://forum.programosy.pl/-vp206299.html#206299

zastosuj killboxa:

C:\WINDOWS\System32\mysvcc.exe

[ Dodano: Dzisiaj o 21:11 ]
działasz w notatniku:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\mysvcig38]
"command"=-

Autor postu otrzymał pochwałę

**Posty:** 214 · przez **muzzy17** 02 Paź 2006, 22:50

mam nadzieje ze to juz wszystko

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:31:59, on 2006-10-02 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\userinit.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe D:\Programy\AntiVir 6\AVWUPSRV.EXE D:\programy\ewido anti-spyware 4.0\guard.exe D:\Programy\ewido anti-spyware 4.0\ewido.exe D:\programy\AutoConnect\AutoConnect.exe D:\Ściągnięte\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [!ewido] "D:\Programy\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [AutoConnect] D:\programy\AutoConnect\AutoConnect.exe O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\Programy\AntiVir 6\AVGUARD.EXE O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\Programy\AntiVir 6\AVWUPSRV.EXE O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\programy\ewido anti-spyware 4.0\guard.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\System32\nvsvc32.exe (file missing)

**Posty:** 935 · przez **Aqui** 02 Paź 2006, 22:59

hijack czysty,silenta wrzuc jeszcze

**Posty:** 214 · przez **muzzy17** 02 Paź 2006, 22:59

kawał dobrej roboty Red , jak zwykle dostałem nie ocenioną pomoc na waszym forum , wielkie dzięki
jeszcze jak bys podał jakieś namiary na dobrego firewalla

**Posty:** 18165 · przez **wojtas** 02 Paź 2006, 23:00

muzzy17 napisał(a):jeszcze jak bys podał jakieś namiary na dobrego firewalla

kerio personal w googlach

Autor postu otrzymał pochwałę

**Posty:** 214 · przez **muzzy17** 03 Paź 2006, 19:23

jeszcze daje logi tak profilaktycznie

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:56:48, on 2006-10-03 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe D:\Programy\AntiVir 6\AVWUPSRV.EXE D:\programy\ewido anti-spyware 4.0\guard.exe D:\programy\Personal Firewall\persfw.exe D:\Programy\ewido anti-spyware 4.0\ewido.exe D:\programy\AutoConnect\AutoConnect.exe D:\programy\Gadu-Gadu\gg.exe D:\programy\Winamp\winamp.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Ściągnięte\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [!ewido] "D:\Programy\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [AutoConnect] D:\programy\AutoConnect\AutoConnect.exe O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{485AC8C5-7429-404E-A3D3-243A8CF2C095}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\Programy\AntiVir 6\AVGUARD.EXE O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\Programy\AntiVir 6\AVWUPSRV.EXE O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\programy\ewido anti-spyware 4.0\guard.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\System32\nvsvc32.exe (file missing) O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - D:\programy\Personal Firewall\persfw.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 48, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "AutoConnect" = "D:\programy\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "!ewido" = ""D:\Programy\ewido anti-spyware 4.0\ewido.exe" /minimized" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "D:\programy\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "D:\programy\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] XPTools\(Default) = "{23F2DE6C-2C3F-4F95-B16A-56714C6FAAF4}" -> {HKLM...CLSID} = "Context Menu Shell Extension" \InProcServer32\(Default) = "C:\WINDOWS\System32\context.dll" ["SuperLogix"] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "D:\programy\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] XPTools\(Default) = "{23F2DE6C-2C3F-4F95-B16A-56714C6FAAF4}" -> {HKLM...CLSID} = "Context Menu Shell Extension" \InProcServer32\(Default) = "C:\WINDOWS\System32\context.dll" ["SuperLogix"] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars Dormant Explorer Bars in "View, Explorer Bar" menu HKLM\Software\Classes\CLSID\{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}\(Default) = "Volet Wanadoo" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}\(Default) = "ToolBand Class" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{5BF498C0-931E-4A4F-B33F-456D07137EAA}\(Default) = "Volet Wanadoo" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ Missing lines (compared with English-language version): "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided) -> {HKLM...CLSID} = "Search Class" \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AntiVir Update, AVWUpSrv, ""D:\Programy\AntiVir 6\AVWUPSRV.EXE"" ["H+BEDV Datentechnik GmbH, Germany"] ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "D:\programy\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."] Kerio Personal Firewall, PersFw, ""D:\programy\Personal Firewall\persfw.exe"" ["Kerio Technologies"] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 21 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 16 seconds. ---------- (total run time: 94 seconds)

**Posty:** 18165 · przez **wojtas** 03 Paź 2006, 19:31

czyste

kolejny log do sprawdzenia...

Kto jest na forum