Otwieranie folderu przy starcie systemu

[ciapus4]

Witam, niewiem jakim cudem, ale od jakiegoś czasu przy starcie systemu uruchamia mi się folder ( E:/programy ), gdzie to mogę wywalić w autostarcie go nie ma.


Pozdrawiam

[Magik]

pierwsza rzecz log z combofixa

druga,

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run.

sprawdz wartosci tych kluczy w rejestrze

[ciapus4]

Kod: Zaznacz wszystko

ComboFix 08-11-12.01 - Mariusz 2008-11-13 20:08:07.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.663 [GMT 1:00]
Uruchomiony z: E:\ComboFix.exe
* Utworzono nowy punkt przywracania
.
[i] ADS - ntoskrnl.exe: deleted 36 bytes in 1 streams. [/i]

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\IE4 Error Log.txt
c:\windows\Readme.txt
c:\windows\system32\MSINET.oca

.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_OREANS32
-------\Service_oreans32


(((((((((((((((((((((((((   Pliki utworzone od 2008-10-13 do 2008-11-13  )))))))))))))))))))))))))))))))
.

2008-11-06 17:41 . 2008-11-06 17:41   <DIR>   d--------   c:\documents and settings\All Users\Dane aplikacji\nView_Profiles
2008-11-06 17:32 . 2008-11-06 17:32   <DIR>   d--------   c:\windows\nview
2008-11-06 17:32 . 2008-10-07 13:33   453,152   --a------   c:\windows\system32\nvudisp.exe
2008-11-06 17:32 . 2008-11-13 20:14   200,819   --a------   c:\windows\system32\nvapps.xml
2008-11-06 17:32 . 2008-10-07 13:33   18,477   --a------   c:\windows\system32\nvdisp.nvu
2008-11-06 17:30 . 2008-10-07 13:33   6,133,856   --a------   c:\windows\system32\drivers\nv4_mini.sys
2008-11-06 17:30 . 2008-10-07 13:33   6,133,856   --a--c---   c:\windows\system32\dllcache\nv4_mini.sys
2008-11-06 17:30 . 2008-10-07 13:33   6,058,112   --a------   c:\windows\system32\nv4_disp.dll
2008-11-06 17:30 . 2008-10-07 13:33   6,058,112   --a--c---   c:\windows\system32\dllcache\nv4_disp.dll
2008-11-05 11:10 . 2008-11-05 11:13   <DIR>   d--------   c:\windows\system32\rserver30
2008-11-05 11:08 . 2008-11-05 11:08   <DIR>   d--------   c:\documents and settings\Mariusz\Dane aplikacji\Radmin
2008-11-01 15:43 . 2008-11-01 15:43   <DIR>   d--------   c:\program files\Outsim
2008-11-01 15:14 . 2008-11-01 15:14   <DIR>   d--------   c:\documents and settings\Mariusz\Dane aplikacji\Photodex

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-13 19:14   26,388   --sha-w   c:\windows\system32\drivers\fidbox.idx
2008-11-13 19:14   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab
2008-11-13 19:12   524,320   --sha-w   c:\windows\system32\drivers\fidbox2.dat
2008-11-13 19:12   4,968   --sha-w   c:\windows\system32\drivers\fidbox2.idx
2008-11-13 19:12   2,964,000   --sha-w   c:\windows\system32\drivers\fidbox.dat
2008-11-08 23:06   107,888   ----a-w   c:\windows\system32\CmdLineExt.dll
2008-11-08 10:27   ---------   d--h--w   c:\program files\InstallShield Installation Information
2008-11-03 10:09   ---------   d-----w   c:\documents and settings\Mariusz\Dane aplikacji\uTorrent
2008-11-01 15:44   ---------   d-----w   c:\program files\Image-Line
2008-11-01 14:47   ---------   d-----w   c:\program files\VstPlugins
2008-10-17 22:41   ---------   d-----w   c:\documents and settings\Mariusz\Dane aplikacji\GanymedeNet
2008-10-04 20:47   ---------   d-----w   c:\program files\Ganymede
2008-10-04 15:51   361,728   ----a-w   c:\windows\system32\TuneUpDefragService.exe
2008-10-04 15:51   ---------   d-----w   c:\program files\TuneUp Utilities 2008
2008-10-04 15:50   ---------   d-----w   c:\program files\Common Files\Wise Installation Wizard
2008-10-04 15:44   2,322,048   ----a-w   c:\windows\system32\TUKernel.exe
2008-10-04 05:56   ---------   d-----w   c:\program files\uTorrent
2008-10-02 09:07   453,152   ----a-w   c:\windows\system32\NVUNINST.EXE
2008-09-29 15:11   ---------   d---a-w   c:\documents and settings\All Users\Dane aplikacji\TEMP
2008-09-29 15:11   ---------   d-----w   c:\program files\WirelessMon
2008-09-29 14:57   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\PassMark
2008-09-23 14:51   ---------   d-----w   c:\program files\Multi Milionerek v2 2008
2008-09-23 14:33   96,976   ----a-w   c:\windows\system32\drivers\klin.dat
2008-09-23 14:33   87,855   ----a-w   c:\windows\system32\drivers\klick.dat
2008-09-23 14:32   ---------   d-----w   c:\program files\Kaspersky Lab
2008-09-23 14:23   ---------   d-----w   c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2007-11-06 17:21   81,920   ----a-w   c:\documents and settings\Mariusz\Dane aplikacji\ezpinst.exe
2007-11-06 17:21   47,360   ----a-w   c:\documents and settings\Mariusz\Dane aplikacji\pcouffin.sys
2006-05-30 15:36   21,376   ----a-w   c:\windows\inf\hopperp.sys
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MULTIMEDIA KEYBOARD"="c:\program files\Netropa\Multimedia Keyboard\MMKeybd.exe" [2002-12-21 167936]
"Vistadrv"="e:\programy 2\Vista Drive Status\vsdrv.exe" [2006-07-30 121089]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-07-29 206088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]

c:\documents and settings\Mariusz\Menu Start\Programy\Autostart\
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 630784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"vidc.i420"= i420vfw.dll
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"msacm.imc"= imc32.acm
"msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\vio\dvacm.acm
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages   REG_MULTI_SZ      msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-08-03 23:55 1667584 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2008-10-07 13:33 13574144 c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PathNvidiaTV]
-ra------ 2005-01-27 11:47 20480 c:\program files\GigaByte\Nvidia\patchnvidiaTVout.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2008-10-07 13:33 86016 c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wscsvc"=2 (0x2)
"Adobe LM Service"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"VGAUtil"=c:\program files\GigaByte\VGA Utility Manager\G-VGA.exe
"NVRTCLK"=c:\windows\system32\NVRTCLK\NVRTClk.exe
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"PCSuiteTrayApplication"=c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
"nwiz"=nwiz.exe /install
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"e:\\gry\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R1 msikbd2k;Multimedia Keyboard Filter Driver;c:\windows\system32\DRIVERS\msikbd2k.sys [2001-12-20 6656]
R2 HopperP;WiFi Hopper;c:\windows\system32\DRIVERS\hopperp.sys [2006-05-30 21376]
R2 nhksrv;Netropa NHK Server;c:\program files\Netropa\Multimedia Keyboard\nhksrv.exe [2001-08-06 28672]
R2 UxTuneUp;TuneUp Theme Extension;c:\windows\System32\svchost.exe [2004-08-03 14336]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;c:\windows\system32\DRIVERS\WlanBZXP.sys [2007-01-10 450560]
S2 BT848;BtCap, WDM Video Capture;c:\windows\system32\drivers\BT848.sys [2002-01-08 266304]
S2 BTTUNER;BtTuner, WDM TvTuner;c:\windows\system32\drivers\BTTUNER.sys [2001-03-07 18944]
S2 BTXBAR;BtXBar, WDM Crossbar;c:\windows\system32\drivers\BTXBAR.sys [1999-07-21 13308]
S3 mirrorv3;mirrorv3;c:\windows\system32\DRIVERS\rminiv3.sys [2006-11-01 3328]
S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;c:\windows\system32\NSNDIS5.SYS [2004-03-24 17280]
S3 PEEK5;PEEK5 Protocol Driver;e:\winair~1\WINAIR~1\PEEK5.SYS [ ]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;c:\windows\System32\TuneUpDefragService.exe [2008-10-04 361728]
S3 WW-600;WW WW-600 USB Infrared Adapter;c:\windows\system32\DRIVERS\WW-600.sys [2005-01-11 17977]
S3 ZDCndis5;ZDCndis5 Protocol Driver;c:\windows\system32\ZDCndis5.SYS [ ]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0acc21c4-4ae4-11da-8155-806d6172696f}]
\Shell\AutoRun\command - G:\launcher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{24cc8245-4e9f-11da-8314-806d6172696f}]
\Shell\AutoRun\command - F:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26363bc4-4b7b-11da-be81-806d6172696f}]
\Shell\AutoRun\command - G:\launcher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{348980c4-4d50-11da-9e62-806d6172696f}]
\Shell\AutoRun\command - G:\launcher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6c9686c4-4af8-11da-a2ed-806d6172696f}]
\Shell\AutoRun\command - G:\launcher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6d47e543-495f-11da-bfce-806d6172696f}]
\Shell\AutoRun\command - F:\menu.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6d47e544-495f-11da-bfce-806d6172696f}]
\Shell\AutoRun\command - G:\launcher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94dae043-37ed-11da-bd7b-806d6172696f}]
\Shell\AutoRun\command - F:\launcher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eb379775-8862-11da-88ee-000feadd9acf}]
\Shell\AutoRun\command - G:\launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{115846D7-A8D9-A47A-0108-000606080207}]
c:\windows\system32\winstart.exe
.
Zawartość folderu 'Zaplanowane zadania'

2008-10-24 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2008-08-27 11:09]

2008-11-13 c:\windows\Tasks\Konserwacja jednym kliknięciem.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-08-27 11:09]
.
.
------- Skan uzupełniający -------
.
FireFox -: Profile - c:\documents and settings\Mariusz\Dane aplikacji\Mozilla\Firefox\Profiles\wt6u0401.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl/
FF -: plugin - c:\documents and settings\Mariusz\Dane aplikacji\Mozilla\plugins\npPxPlay.dll
FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\Java\jre1.5.0_07\bin\NPJava11.dll
FF -: plugin - c:\program files\Java\jre1.5.0_07\bin\NPJava12.dll
FF -: plugin - c:\program files\Java\jre1.5.0_07\bin\NPJava13.dll
FF -: plugin - c:\program files\Java\jre1.5.0_07\bin\NPJava14.dll
FF -: plugin - c:\program files\Java\jre1.5.0_07\bin\NPJava32.dll
FF -: plugin - c:\program files\Java\jre1.5.0_07\bin\NPJPI150_07.dll
FF -: plugin - c:\program files\Java\jre1.5.0_07\bin\NPOJI610.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npganymedenet.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-13 20:14:16
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

PROCES: c:\windows\explorer.exe
-> c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Netropa\Onscreen Display\osd.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Czas ukończenia: 2008-11-13 20:18:00 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2008-11-13 19:17:47

Przed: 3 130 195 968 bajtów wolnych
Po: 3,019,927,552 bajtów wolnych

WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /TUTag=170T8H /Kernel=TUKernel.exe
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional (TuneUp Backup)" /fastdetect /TUTag=170T8H-BAK

223

[Magik]

ten log wstaw w tagi 'code'


wklej do notatanika

Kod: Zaznacz wszystko

Windows Registry Editor Version 5.00


[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0acc21c4-4ae4-11da-8155-806d6172696f}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{24cc8245-4e9f-11da-8314-806d6172696f}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26363bc4-4b7b-11da-be81-806d6172696f}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6c9686c4-4af8-11da-a2ed-806d6172696f}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6d47e543-495f-11da-bfce-806d6172696f}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6d47e544-495f-11da-bfce-806d6172696f}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94dae043-37ed-11da-bd7b-806d6172696f}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eb379775-8862-11da-88ee-000feadd9acf}]

zapisz jako fix.reg i odpal


1.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
2.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

dla pewnosci
Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt

[ciapus4]

Kod: Zaznacz wszystko

[b]SDFix: Version 1.240 [/b]
Run by Mariusz on 2008-11-14 at 19:18

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:



                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-14 19:22:10
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:861550be
"s2"=dword:1a5a2f41
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"p0"="C:\Program Files\DAEMON Tools Pro\"
"h0"=dword:00000001
"hdf12"=hex:01,d4,cb,d5,a0,f2,d4,05,f2,3e,f4,aa,c9,2a,52,9f,17,ac,b2,b2,c8,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,84,e6,a5,1c,5f,fd,c7,2c,64,07,3a,10,38,23,4f,ec,0a,..
"hdf12"=hex:a0,45,bd,e1,27,63,8f,77,09,83,c4,94,5f,32,ed,85,60,8e,df,2d,0d,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:b9,59,26,86,78,c5,99,7f,a9,bc,0a,87,a1,8b,9a,e9,c6,00,ca,6b,cb,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,7b,e2,9c,1c,70,59,83,e9,b7,0c,bc,e3,9c,98,7d,24,ae,..
"hdf12"=hex:21,68,0b,bf,fe,d3,eb,23,71,af,a7,d4,c5,13,df,f2,7f,ce,7d,32,08,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:3a,90,c4,fd,5a,c5,a3,2d,8d,69,2c,71,d8,97,7d,7b,73,41,30,de,a7,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq1]
"hdf12"=hex:8f,36,e6,2c,a3,f1,94,98,4e,87,9e,e6,29,7a,94,de,9b,fb,a8,49,6c,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:d9,e5,ba,66,76,06,52,81,ad,c3,2b,7e,df,5a,86,e2,1a,aa,92,96,8a,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vax347s\Config\jdgg40]
"ujdew"=hex:20,02,00,00,9e,82,79,fa,78,82,d8,ab,bb,80,e4,de,32,69,c7,43,bd,..
"ljej40"=hex:4a,06,9d,18,2b,bb,1d,a9,3b,64,f5,97,08,ba,12,6d,50,d4,85,f4,ef,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:bd,23,16,bf,8d,a9,3f,f6,05,64,43,e7,b7,ca,20,37,49,bc,2c,36,a7,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,2d,72,0d,48,7a,70,69,cc,a5,39,b2,c1,bb,61,3b,f4,53,..
"khjeh"=hex:cc,28,83,d1,f2,2f,e9,11,c0,df,a5,72,23,c6,f4,53,02,b1,7f,3f,6b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:83,2b,11,76,43,0f,cd,57,64,77,0b,56,7a,c0,da,bb,29,54,99,d2,ee,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:0c,04,43,7c,fd,99,f8,68,a2,4a,b4,0f,be,96,80,bf,d5,98,b8,1d,09,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,2d,72,0d,48,7a,70,69,cc,a5,39,b2,c1,bb,61,3b,f4,53,..
"khjeh"=hex:cc,28,83,d1,f2,2f,e9,11,c0,df,a5,72,23,c6,f4,53,02,b1,7f,3f,6b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:89,9e,73,d8,6b,06,74,4c,14,80,23,e0,eb,6f,f8,c0,c7,16,e0,30,81,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"p0"="C:\Program Files\DAEMON Tools Pro\"
"h0"=dword:00000001
"hdf12"=hex:ad,f3,d7,1c,43,0f,35,96,ed,6a,e2,6c,6e,43,e5,a4,4b,6f,55,9c,6c,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,84,e6,a5,1c,5f,fd,c7,2c,64,07,3a,10,38,23,4f,ec,0a,..
"hdf12"=hex:1b,c2,ec,1d,ec,f8,5e,23,39,80,0d,5c,3c,96,7e,34,c3,41,84,1d,a5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:fc,4e,ea,1f,8e,b5,66,1a,9a,e5,13,1f,a1,0b,3a,b2,97,82,bb,ad,6d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,7b,e2,9c,1c,70,59,83,e9,b7,0c,bc,e3,9c,98,7d,24,ae,..
"hdf12"=hex:be,56,c2,7f,22,51,07,ca,bb,eb,e9,49,f3,a6,ef,d0,25,ac,5e,fa,ad,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:18,f6,f1,e8,0a,50,5c,04,fc,ef,05,af,a1,b7,e3,9d,64,e4,63,28,4c,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:d9,e5,ba,66,76,06,52,81,ad,c3,2b,7e,df,5a,86,e2,1a,aa,92,96,8a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"p0"="C:\Program Files\DAEMON Tools Pro\"
"h0"=dword:00000001
"hdf12"=hex:01,d4,cb,d5,a0,f2,d4,05,f2,3e,f4,aa,c9,2a,52,9f,17,ac,b2,b2,c8,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,84,e6,a5,1c,5f,fd,c7,2c,64,07,3a,10,38,23,4f,ec,0a,..
"hdf12"=hex:a0,45,bd,e1,27,63,8f,77,09,83,c4,94,5f,32,ed,85,60,8e,df,2d,0d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:b9,59,26,86,78,c5,99,7f,a9,bc,0a,87,a1,8b,9a,e9,c6,00,ca,6b,cb,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,7b,e2,9c,1c,70,59,83,e9,b7,0c,bc,e3,9c,98,7d,24,ae,..
"hdf12"=hex:21,68,0b,bf,fe,d3,eb,23,71,af,a7,d4,c5,13,df,f2,7f,ce,7d,32,08,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:3a,90,c4,fd,5a,c5,a3,2d,8d,69,2c,71,d8,97,7d,7b,73,41,30,de,a7,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq1]
"hdf12"=hex:8f,36,e6,2c,a3,f1,94,98,4e,87,9e,e6,29,7a,94,de,9b,fb,a8,49,6c,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:d9,e5,ba,66,76,06,52,81,ad,c3,2b,7e,df,5a,86,e2,1a,aa,92,96,8a,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OODEFRAG08.00.00.01WORKSTATION"="F3C146A5F07C4A22D35E3A5F7F8D85A97DDAAB6822EC8CC071209420CA97E6C8209D75243CE89607DF59909EAB38B8B5379D791AB08481A974A869F40337F87C997774550F6E14DA8D1C03B4D5DF984C2D219CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E6678EDD5E5BE2F6E667FEBC9E127BECC74CFEBC9E127BECC74C3A796511ABF99D1C675EA3F7D7FE6BAB99368AAC581F2A6D35A9B98EC56B24108B18F132E9E71D5EEF7F6F44990E3E0C482A5A3E922F07D0BCAC466A6D93D755F0BA3D37237608724F4563DF1ED28AB9E16921DDDA742453BE36E1AC9F65342D01B7E65F38A30BF1D5D8A007CD2D4EDA90151E63465470CADEFA116BB76C38B6FA77D29D6D3DD56A79F78B2976D00B0CA3DFDADC4909DEFCE4C21A727787E70A3DF6291B6E681E5E54764D6BCCC7C6590F111F8CC19FE6A73CE809BE81E849ACCD475732C61B9BC2243AD3A665ED8AC8E7047966ED7981F9F460AB83DE986B1E558F0BF168A28B04CABCD0E7BBF464D069273C1672CE2E19432A96287DEFDA4EA1873B9EA89DAEFDCE8CB7EEAD61E65BF37F7E76D426709AFE6021462B9E2CA2227D1E3041014904594CC2AF7D0BA54888A2191B825FCC8CA3AFE42C1FA7F7746D51AF51CE14235B39B2EED2D1A03C69CF3C2B49C8AAD06FD256415D6EDFD7103A78B162D3728ABDDE087DB6B4A04707928B16795D8F0936CDAB5A8F98F46DB6E77DA776B40C50D961ACF3E91560E8DBC165805A56E608C87D1597ACFC635C1EF47C59543BA447D1FA139A32450AC618EFAED34C2F5E65036F10A2555EFECA6E8828D27816D3C93B8740FD867C1A885C52653FE64678BB36D02DEB5AE76EE5456A446492548634200CCDF09453DF5F41C5163571E00B2925F790274224ACDB32872B2305EC7AE5FE2BEB88BDC9817A51C8E46A6A26BE5108DB7149C78488E1BCF0486568394544C831DB9C9540F6110CFD0AD982A012D88A179D8E5A5CA3AE5C5B9FC88876CDB8658BF4CBE2000EDA64ABCF4121BF566C4E6B75769BE475FDFE9F44ACE3C44F2F2D4B9F76A530E597C0BD96A35E58B1B9E6BCEB44E23BC90F84BA60372EAB5B98EE275AC10B62F507FBC250C5889F9EF3DA9109FE3ADD3EA642CDB1CCCF9354696C78B9957A8704EF66ED85B3A032E9D1A796EA715FB1458B819D099C63C8F199DC3DE2A18A752E9C42154F39DB8F350DBC9B402B4500270A7F144B16B87EC0A768978ED509E7E5D84734DF6B249BF6657E15CDFD93757DF06DBBF1ECD2C9A012AD4D8CE675FA6EF69E6A789D171C799CC3996C83A3A03795EE488A99EA23C35FBE48BECE05B4624DE8F8716B863E58F9D96788158478184C1F8B36D86AE8B39722961CC920F72D363AC83533F68F8747815BA1D27853"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts]
"R:ttpick (TrueType)"="Rattpick.ttf"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"E:\\gry\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="E:\\gry\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM)"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Fri 27 Feb 2004       233,472 A..H. --- "C:\Program Files\Image-Line\FL Studio 7\REX Shared Library.dll"
Tue 11 Nov 2008         1,714 ...HR --- "C:\Documents and Settings\Mariusz\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak"

[b]Finished![/b]



[Magik]

komp juz jest czysty//ten folder nadal sie otwiera??

w rejestrze tez sprawdzales??

[ciapus4]

Witam, nadal się otwiera, a co do rejestrów

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run.

to mam tylko same HKEY ? , a dlaczego jak wpisuje msconfig to wyskakuje okno, że winda nie może otworzyć polecenia i lipa ?

[Magik]

zle robisz




powienienes miec liste jak ja po prawej stronie


i jaki program ostatnio instalowales?? chociazby nero powoduje otwieranie sie folderow przy starcie//

[ciapus4]

To może łopatologicznie wpisuje w uruchom regedit i enter i mam takie coś

[Magik]

To może łopatologicznie wpisuje w uruchom regedit i enter i mam takie coś

no ok i musisz rzwinac te klucze w tym kierunku-->SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

kliknij na ten krzyzyk i rozwijaj liste

[ciapus4]

znalazłem ten RUN ale trochę w innym ciągu i wykasowałem i pomogło dzięki za pomoc, temat można zamknąć. Jeszcze raz dzięki i pozdrawiam