prosze o sprawdzenie loga.

**Posty:** 174 · przez **cinek2007** 11 Maj 2006, 19:25

Mam wielki problem z siecią. Dzisiaj przyszłem ze szkoły, włanczam kompa a tu Outlook niedziała (gdy sprawdzam wiadomości wyskakuje błąd że niemożna nawiązać połączenia) gg tak samo, niemoże się połączyć, e-Mule też, jedynie internet chodzi dobrze, niewiem co się mogło stać, wczoraj jeszcze było wszystko dobrze. Antywirus niewykrywa żadnych wirusów. Może ktoś mi sprawdzić loga?:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 17:53:42, on 2006-05-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\SYSTEM32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\Program Files\TGTSoft\StyleXP\StyleXPService.exe D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe D:\WINDOWS\SYSTEM32\Ati2evxx.exe D:\WINDOWS\Explorer.EXE D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe D:\Program Files\Common Files\Symantec Shared\ccProxy.exe D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe D:\WINDOWS\system32\spoolsv.exe D:\Program Files\ewido anti-malware\ewidoctrl.exe D:\Program Files\NIS2006\Norton AntiVirus\navapsvc.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe D:\WINDOWS\PowerS.exe D:\Program Files\Common Files\Symantec Shared\ccApp.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\HACE\Mmm\Mmm.exe F:\Marcin\Skróty\PrivacyEraser.exe D:\Program Files\NetMeter\NetMeter.exe D:\WINDOWS\system32\RaConfig.exe D:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE D:\Program Files\ewido anti-malware\SecuritySuite.exe F:\Marcin\Skróty\Do usowania szkodnikow z systemu\HijackThis.exe D:\Program Files\Internet Explorer\IEXPLORE.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - <default> - (no file) F3 - REG:win.ini: load= F2 - REG:system.ini: UserInit=D:\WINDOWS\regedit /s D:\pav.reg,D:\WINDOWS\system32\pavdr.exe,D:\WINDOWS\system32\userinit.exe, O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: CBTB00001 - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - D:\PROGRA~1\Skype\toolbars\SKYPEF~1\toolbar.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - D:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - D:\Program Files\NIS2006\Norton AntiVirus\NavShExt.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: Skype™ For Internet Explorer - {B13721C7-F507-4982-B2E5-502A71474FED} - D:\Program Files\Skype\toolbars\Skype for Internet Explorer\toolbar.dll O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - D:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - D:\Program Files\NIS2006\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [PowerS] D:\WINDOWS\PowerS.exe O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Mmm] "D:\Program Files\HACE\Mmm\Mmm.exe" O4 - HKCU\..\Run: [Privacy Eraser Pro] F:\Marcin\Skróty\PrivacyEraser.exe /Startup O4 - HKCU\..\Run: [D:\Program Files\NetMeter\NetMeter.exe] D:\Program Files\NetMeter\NetMeter.exe O4 - HKCU\..\Run: [eMuleAutoStart] D:\Program Files\eMule\emule.exe -AutoStart O4 - Startup: FlashGet.lnk = D:\Program Files\FlashGet\flashget.exe O4 - Global Startup: RaConfig.lnk = D:\WINDOWS\system32\RaConfig.exe O8 - Extra context menu item: &Search - O8 - Extra context menu item: Download with Internet TOOLS - D:\Program Files\MarBit\TOOLS\MBdownload.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - D:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - D:\Program Files\FlashGet\jc_all.htm O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - D:\Program Files\VisualRoute\vrie.dll O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - D:\Program Files\VisualRoute\vrie.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Wallpaper - {c23dd370-cb79-11d2-898a-00c04f80a47f} - D:\Program Files\Internet Explorer\Toolbar\toolbar.hta O9 - Extra 'Tools' menuitem: &Toolbar Wallpaper - {c23dd370-cb79-11d2-898a-00c04f80a47f} - D:\Program Files\Internet Explorer\Toolbar\toolbar.hta O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {A854AD6D-6DB5-41FB-8044-0BD38092A007} (Ganymede Sudoku) - http://67.15.101.3/g_bin/pl/sudoku_2_0_0_9.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_24.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C6} (GameDesire Pool 8UK) - http://67.15.101.3/g_bin/pl/billard8UK_2_0_0_24.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{FEF45600-A077-4CE7-AFDE-A6CAFC686138}: NameServer = 172.17.1.1 O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - D:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: WRNotifier - D:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: Ati HotKey Poller - Unknown owner - D:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe O23 - Service: B - Unknown owner - D:\DOCUME~1\TRZCIS~1\USTAWI~1\Temp\B.exe (file missing) O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - D:\Program Files\NIS2006\ccPwdSvc.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: COM Host (comHost) - Symantec Corporation - D:\Program Files\NIS2006\comHost.exe O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Machine Debug Manager (MDM) - Unknown owner - D:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (file missing) O23 - Service: Usługa Auto-Protect programu Norton AntiVirus (navapsvc) - Symantec Corporation - D:\Program Files\NIS2006\Norton AntiVirus\navapsvc.exe O23 - Service: Usługa Norton Protection Center (NSCService) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: NTBOOTMGR (NTBOOT) - Unknown owner - D:\WINDOWS\SYSTEM\DRIVER\ntuser.exe (file missing) O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - D:\Program Files\NIS2006\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: StyleXPService - Unknown owner - D:\Program Files\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe O23 - Service: Symantec Core LC - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Windows Log - Unknown owner - D:\WINDOWS\system32\nvsvcd.exe (file missing)

....a jeszcze gry-online niedziałają, też wyskakuje błąd, że niemożna się podłączyć do serwera.

**Posty:** 8694 · przez **Red** 11 Maj 2006, 20:26

usuwasz z wylaczonym przywracaniem systemu w xp i w trybie awaryjnym f8

R3 - URLSearchHook: (no name) - <default> - (no file)
F3 - REG:win.ini: load=
F2 - REG:system.ini: UserInit=D:\WINDOWS\regedit /s D:\pav.reg,D:\WINDOWS\system32\pavdr.exe,D:\WINDOWS\system32\userinit.exe,
O8 - Extra context menu item: &Search -
O23 - Service: B - Unknown owner - D:\DOCUME~1\TRZCIS~1\USTAWI~1\Temp\B.exe (file missing)
O23 - Service: NTBOOTMGR (NTBOOT) - Unknown owner - D:\WINDOWS\SYSTEM\DRIVER\ntuser.exe (file missing)
O23 - Service: Windows Log - Unknown owner - D:\WINDOWS\system32\nvsvcd.exe (file missing)

zaznacz wpisy w hiajcku i nacisnij fix to co pogrubiłem usun recznie i po akcji daj logi do kontroli

z hijack this oraz z sileny runners

otwierasz link>> http://www.silentrunners.org/Silent%20Runners.vbs >>zapisujesz jako na pulpicie>>klikasz dwa razy >>masz wybor i wybierasz no>>i czekasz troszke az wygeneruje sie cały log do konca
wrzucasz na forum

ps

znasz to:

O4 - HKCU\..\Run: [Mmm] "D:\Program Files\HACE\Mmm\Mmm.exe"

Autor postu otrzymał pochwałę

**Posty:** 4441 · przez **Amistad18** 11 Maj 2006, 22:26

D:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

musze napisać.... jak to zobaczyłem...

weź jak najszybciej wywal to cenzura co zamula system.... polecam ściągnąć to :

( właśnie wysłałem na rapida, tam masz też opis jak zainstalować itp )

http://rapidshare.de/files/20211016/themes.rar.html

Autor postu otrzymał pochwałę

**Posty:** 8694 · przez **Red** 13 Maj 2006, 14:50

cinek2007 prosze o logi kontrolne

**Posty:** 174 · przez **cinek2007** 14 Maj 2006, 10:36

OK, już daje:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 09:08:07, on 2006-05-14 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\SYSTEM32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe D:\WINDOWS\SYSTEM32\Ati2evxx.exe D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe D:\WINDOWS\Explorer.EXE D:\Program Files\Common Files\Symantec Shared\ccProxy.exe D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe D:\WINDOWS\system32\spoolsv.exe D:\Program Files\NIS2006\Norton AntiVirus\navapsvc.exe D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe D:\Program Files\Common Files\Symantec Shared\ccApp.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\HACE\Mmm\Mmm.exe F:\Marcin\Skróty\PrivacyEraser.exe D:\Program Files\NetMeter\NetMeter.exe D:\WINDOWS\system32\RaConfig.exe D:\WINDOWS\system32\wuauclt.exe D:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE F:\Marcin\Skróty\Do usowania szkodnikow z systemu\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: CBTB00001 - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - D:\PROGRA~1\Skype\toolbars\SKYPEF~1\toolbar.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - D:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - D:\Program Files\NIS2006\Norton AntiVirus\NavShExt.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: Skype™ For Internet Explorer - {B13721C7-F507-4982-B2E5-502A71474FED} - D:\Program Files\Skype\toolbars\Skype for Internet Explorer\toolbar.dll O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - D:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - D:\Program Files\NIS2006\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Mmm] "D:\Program Files\HACE\Mmm\Mmm.exe" O4 - HKCU\..\Run: [Privacy Eraser Pro] F:\Marcin\Skróty\PrivacyEraser.exe /Startup O4 - HKCU\..\Run: [eMuleAutoStart] D:\Program Files\eMule\emule.exe -AutoStart O4 - HKCU\..\Run: [D:\Program Files\NetMeter\NetMeter.exe] D:\Program Files\NetMeter\NetMeter.exe O4 - Global Startup: RaConfig.lnk = D:\WINDOWS\system32\RaConfig.exe O8 - Extra context menu item: Download with Internet TOOLS - D:\Program Files\MarBit\TOOLS\MBdownload.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - D:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - D:\Program Files\FlashGet\jc_all.htm O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - D:\Program Files\VisualRoute\vrie.dll O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - D:\Program Files\VisualRoute\vrie.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Wallpaper - {c23dd370-cb79-11d2-898a-00c04f80a47f} - D:\Program Files\Internet Explorer\Toolbar\toolbar.hta O9 - Extra 'Tools' menuitem: &Toolbar Wallpaper - {c23dd370-cb79-11d2-898a-00c04f80a47f} - D:\Program Files\Internet Explorer\Toolbar\toolbar.hta O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {A854AD6D-6DB5-41FB-8044-0BD38092A007} (Ganymede Sudoku) - http://67.15.101.3/g_bin/pl/sudoku_2_0_0_9.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_24.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C6} (GameDesire Pool 8UK) - http://67.15.101.3/g_bin/pl/billard8UK_2_0_0_24.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{FEF45600-A077-4CE7-AFDE-A6CAFC686138}: NameServer = 172.17.1.1 O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - D:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O20 - Winlogon Notify: WRNotifier - D:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: Ati HotKey Poller - Unknown owner - D:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - D:\Program Files\NIS2006\ccPwdSvc.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: COM Host (comHost) - Symantec Corporation - D:\Program Files\NIS2006\comHost.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Machine Debug Manager (MDM) - Unknown owner - D:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (file missing) O23 - Service: Usługa Auto-Protect programu Norton AntiVirus (navapsvc) - Symantec Corporation - D:\Program Files\NIS2006\Norton AntiVirus\navapsvc.exe O23 - Service: Usługa Norton Protection Center (NSCService) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: NTBOOTMGR (NTBOOT) - Unknown owner - D:\WINDOWS\SYSTEM\DRIVER\ntuser.exe (file missing) O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - D:\Program Files\NIS2006\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (file missing) O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe O23 - Service: Symantec Core LC - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 44, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "D:\WINDOWS\system32\ctfmon.exe" [MS] "Mmm" = ""D:\Program Files\HACE\Mmm\Mmm.exe"" [null data] "Privacy Eraser Pro" = "F:\Marcin\Skróty\PrivacyEraser.exe /Startup" [null data] "eMuleAutoStart" = "D:\Program Files\eMule\emule.exe -AutoStart" ["http://www.emule-project.net"] "D:\Program Files\NetMeter\NetMeter.exe" = "D:\Program Files\NetMeter\NetMeter.exe" [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "arp" = (empty string) "neth" = (empty string) "Tweak UI" = "RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp" [MS] "ccApp" = ""D:\Program Files\Common Files\Symantec Shared\ccApp.exe"" ["Symantec Corporation"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {00C6482D-C502-44C8-8409-FCE54AD9C208}\(Default) = (no title provided) -> {HKLM...CLSID} = "HelperObject Class" \InProcServer32\(Default) = "D:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll" ["TechSmith Corporation"] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "D:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {22BF413B-C6D2-4d91-82A9-A0F997BA588C}\(Default) = "CBTB00001" -> {HKLM...CLSID} = "CBTB00001 Class" \InProcServer32\(Default) = "D:\PROGRA~1\Skype\toolbars\SKYPEF~1\toolbar.dll" ["IE Toolbar"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] {9ECB9560-04F9-4bbc-943D-298DDF1699E1}\(Default) = "Norton Internet Security 2006" -> {HKLM...CLSID} = "CNisExtBho Class" \InProcServer32\(Default) = "D:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"] {A5366673-E8CA-11D3-9CD9-0090271D075B}\(Default) = (no title provided) -> {HKLM...CLSID} = "IeCatch2 Class" \InProcServer32\(Default) = "D:\PROGRA~1\FlashGet\jccatch.dll" ["Amaze Soft"] {A8F38D8D-E480-4D52-B7A2-731BB6995FDD}\(Default) = "NAV Helper" -> {HKLM...CLSID} = "CNavExtBho Class" \InProcServer32\(Default) = "D:\Program Files\NIS2006\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "D:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "D:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{D0FAC080-AE1A-11ce-8016-CE90976DC901}" = "Picture Publisher File Viewer" -> {HKLM...CLSID} = "Picture Publisher File Viewer" \InProcServer32\(Default) = "ppiv30.dll" [null data] "{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser" -> {HKLM...CLSID} = "Nokia Phone Browser" \InProcServer32\(Default) = "D:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"] "{C0C4375A-5B72-4efe-929D-3B848C3A1E91}" = "Message View" -> {HKLM...CLSID} = "Message View" \InProcServer32\(Default) = "D:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll" ["Nokia"] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "D:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"] "{ED65AC21-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device" -> {HKLM...CLSID} = "Siemens Device" \InProcServer32\(Default) = "D:\Program Files\Mobile Phone Manager\DES\DESShellExt.dll" ["Siemens AG"] "{ED65AC22-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device ContextMenuHandler" -> {HKLM...CLSID} = "Siemens Device ContextMenuHandler" \InProcServer32\(Default) = "D:\Program Files\Mobile Phone Manager\DES\DESShellExt.dll" ["Siemens AG"] "{ED65AC23-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens SX1 PropertySheetHandler" -> {HKLM...CLSID} = "Siemens Device PropertySheetHandler" \InProcServer32\(Default) = "D:\Program Files\Mobile Phone Manager\DES\DESShellExt.dll" ["Siemens AG"] "{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band" -> {HKLM...CLSID} = "Shell Search Band" \InProcServer32\(Default) = "D:\WINDOWS\system32\browseui.dll" [MS] "{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band" -> {HKLM...CLSID} = "History Band" \InProcServer32\(Default) = "D:\WINDOWS\system32\shdocvw.dll" [MS] "{3028902F-6374-48b2-8DC6-9725E775B926}" = "IE Microsoft AutoComplete" -> {HKLM...CLSID} = "IE Microsoft AutoComplete" \InProcServer32\(Default) = "D:\WINDOWS\system32\Browseui.dll" [MS] "{661825E5-B9A4-4D3E-8B74-3B6B63C32A80}" = "Shell Extensions for Font Creator" -> {HKLM...CLSID} = "Shell Extensions for Font Creator" \InProcServer32\(Default) = "D:\PROGRA~1\HIGH-L~1\FONTCR~1\FCPSHL.dll" ["High-Logic"] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "D:\Program Files\ACE Mega CoDecS Pack\SystemS\RealMedia\rpshell.dll" ["RealNetworks, Inc."] "{ED65AB21-B24F-11d3-BA80-00C0CA16AA37}" = "Mobile" -> {HKLM...CLSID} = "Mobile" \InProcServer32\(Default) = "D:\Program Files\Siemens Data Suite\DES\DESShellExt.dll" ["Siemens AG"] "{ED65AB22-B24F-11d3-BA80-00C0CA16AA37}" = "Mobile ContextMenuHandler" -> {HKLM...CLSID} = "Mobile ContextMenuHandler" \InProcServer32\(Default) = "D:\Program Files\Siemens Data Suite\DES\DESShellExt.dll" ["Siemens AG"] "{ED65AB23-B24F-11d3-BA80-00C0CA16AA37}" = "Mobile PropertySheetHandler" -> {HKLM...CLSID} = "Mobile PropertySheetHandler" \InProcServer32\(Default) = "D:\Program Files\Siemens Data Suite\DES\DESShellExt.dll" ["Siemens AG"] "{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}" = "SnagIt" -> {HKLM...CLSID} = "SnagIt" \InProcServer32\(Default) = "D:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll" ["TechSmith Corporation"] "{CF74B903-3389-469c-B3B6-0204D204FCBD}" = "SnagIt Shell Extension" -> {HKLM...CLSID} = "SnagItShellExt Class" \InProcServer32\(Default) = "D:\Program Files\TechSmith\SnagIt 8\SnagItShellExt.dll" ["TechSmith Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Program Files\WinRAR2323232\rarext.dll" [null data] "{1530F7EE-5128-43BD-9977-84A4B0FAD7DF}" = "PhotoToys" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "D:\WINDOWS\system32\phototoys.dll" [MS] "{E54B19BC-69B6-43B2-A1F2-15BBC1D72C93}" = "wodShellMenu" -> {HKLM...CLSID} = "wodShellMenu" \InProcServer32\(Default) = "D:\WINDOWS\system32\wodshellmenu.dll" ["WeOnlyDo! COM"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "D:\Program Files\ewido anti-malware\shellhook.dll" ["TODO: <Firmenname>"] HKLM\System\CurrentControlSet\Control\Session Manager\ INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e SsiEfr.e" [file not found], [MS], [file not found], [file not found], [file not found] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] INFECTION WARNING! WRNotifier\DLLName = "WRLogonNTF.dll" ["Webroot Software, Inc."] HKLM\Software\Classes\PROTOCOLS\Filter\ INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "D:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}" -> {HKLM...CLSID} = "Ctest Object" \InProcServer32\(Default) = "D:\Program Files\ewido anti-malware\context.dll" ["ewido networks"] FileEncrypt\(Default) = "{90A07ACC-0331-4aee-9AAD-A854A9C37667}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "D:\Program Files\Advanced System Optimizer\ShellExt.dll" ["Systweak Inc"] SnagItMainShellExt\(Default) = "{CF74B903-3389-469c-B3B6-0204D204FCBD}" -> {HKLM...CLSID} = "SnagItShellExt Class" \InProcServer32\(Default) = "D:\Program Files\TechSmith\SnagIt 8\SnagItShellExt.dll" ["TechSmith Corporation"] Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "D:\Program Files\NIS2006\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Program Files\WinRAR2323232\rarext.dll" [null data] wodShellMenu\(Default) = "{E54B19BC-69B6-43B2-A1F2-15BBC1D72C93}" -> {HKLM...CLSID} = "wodShellMenu" \InProcServer32\(Default) = "D:\WINDOWS\system32\wodshellmenu.dll" ["WeOnlyDo! COM"] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}" -> {HKLM...CLSID} = "Ctest Object" \InProcServer32\(Default) = "D:\Program Files\ewido anti-malware\context.dll" ["ewido networks"] FileEncrypt\(Default) = "{90A07ACC-0331-4aee-9AAD-A854A9C37667}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "D:\Program Files\Advanced System Optimizer\ShellExt.dll" ["Systweak Inc"] SnagItMainShellExt\(Default) = "{CF74B903-3389-469c-B3B6-0204D204FCBD}" -> {HKLM...CLSID} = "SnagItShellExt Class" \InProcServer32\(Default) = "D:\Program Files\TechSmith\SnagIt 8\SnagItShellExt.dll" ["TechSmith Corporation"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Program Files\WinRAR2323232\rarext.dll" [null data] wodShellMenu\(Default) = "{E54B19BC-69B6-43B2-A1F2-15BBC1D72C93}" -> {HKLM...CLSID} = "wodShellMenu" \InProcServer32\(Default) = "D:\WINDOWS\system32\wodshellmenu.dll" ["WeOnlyDo! COM"] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "D:\Program Files\NIS2006\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Program Files\WinRAR2323232\rarext.dll" [null data] wodShellMenu\(Default) = "{E54B19BC-69B6-43B2-A1F2-15BBC1D72C93}" -> {HKLM...CLSID} = "wodShellMenu" \InProcServer32\(Default) = "D:\WINDOWS\system32\wodshellmenu.dll" ["WeOnlyDo! COM"] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "D:\Documents and Settings\Trzciński\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "Trzciński" & "All Users" startup folders: ----------------------------------------------------------- D:\Documents and Settings\All Users\Menu Start\Programy\Autostart "RaConfig" -> shortcut to: "D:\WINDOWS\system32\RaConfig.exe" ["Ralink Technology, Corp."] Enabled Scheduled Tasks: ------------------------ "Norton AntiVirus - Uruchom pełne skanowanie systemu - Trzciński" -> launches: "D:\PROGRA~1\NIS2006\NORTON~1\Navw32.exe /TASK:"D:\Documents and Settings\All Users\Dane aplikacji\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"] "Symantec NetDetect" -> launches: "D:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ "{C4069E3A-68F1-403E-B40E-20066696354B}" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "D:\Program Files\NIS2006\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{B13721C7-F507-4982-B2E5-502A71474FED}" -> {HKLM...CLSID} = "Skype™ For Internet Explorer" \InProcServer32\(Default) = "D:\Program Files\Skype\toolbars\Skype for Internet Explorer\toolbar.dll" ["IE Toolbar"] "{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}" -> {HKLM...CLSID} = "Norton Internet Security 2006" \InProcServer32\(Default) = "D:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"] "{C4069E3A-68F1-403E-B40E-20066696354B}" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "D:\Program Files\NIS2006\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar" -> {HKLM...CLSID} = "FlashGet Bar" \InProcServer32\(Default) = "D:\PROGRA~1\FlashGet\fgiebar.dll" ["Amaze Soft"] "{B13721C7-F507-4982-B2E5-502A71474FED}" = (no title provided) -> {HKLM...CLSID} = "Skype™ For Internet Explorer" \InProcServer32\(Default) = "D:\Program Files\Skype\toolbars\Skype for Internet Explorer\toolbar.dll" ["IE Toolbar"] "{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}" = (no title provided) -> {HKLM...CLSID} = "SnagIt" \InProcServer32\(Default) = "D:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll" ["TechSmith Corporation"] "{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}" = "Norton Internet Security 2006" -> {HKLM...CLSID} = "Norton Internet Security 2006" \InProcServer32\(Default) = "D:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"] "{C4069E3A-68F1-403E-B40E-20066696354B}" = "Norton AntiVirus" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "D:\Program Files\NIS2006\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {04849C74-016E-4A43-8AA5-1F01DE57F4A1}\ "ButtonText" = "Trace" "MenuText" = "VisualRoute Trace" "CLSIDExtension" = "{8C85E2EE-9FD6-11D5-B770-504D54C10000}" -> {HKLM...CLSID} = "vrie" \InProcServer32\(Default) = "D:\Program Files\VisualRoute\vrie.dll" ["VisualWare"] {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in" \InProcServer32\(Default) = "D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_06" \InProcServer32\(Default) = "D:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {C23DD370-CB79-11D2-898A-00C04F80A47F}\ "ButtonText" = "Wallpaper" "MenuText" = "&Toolbar Wallpaper" "Exec" = "D:\Program Files\Internet Explorer\Toolbar\toolbar.hta" [null data] {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "&FlashGet" "Exec" = "D:\PROGRA~1\FlashGet\flashget.exe" ["Amaze Soft"] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, "D:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] Symantec Core LC, Symantec Core LC, ""D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe"" ["Symantec Corporation"] Symantec Event Manager, ccEvtMgr, ""D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"] Symantec Network Drivers Service, SNDSrvc, ""D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"" ["Symantec Corporation"] Symantec Network Proxy, ccProxy, ""D:\Program Files\Common Files\Symantec Shared\ccProxy.exe"" ["Symantec Corporation"] Symantec Settings Manager, ccSetMgr, ""D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"] Symantec SPBBCSvc, SPBBCSvc, ""D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"" ["Symantec Corporation"] Usługa Auto-Protect programu Norton AntiVirus, navapsvc, ""D:\Program Files\NIS2006\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"] Usługa Norton Protection Center, NSCService, ""D:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE"" ["Symantec Corporation"] Webroot Spy Sweeper Engine, svcWRSSSDK, "D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe" ["Webroot Software, Inc."] Windows User Mode Driver Framework, UMWdf, "D:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ FPP2:\Driver = "fppmon2.dll" ["FinePrint Software, LLC"] hpzsnt10\Driver = "hpzsnt10.dll" ["HP"] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points and all Registry CLSIDs for dormant Explorer Bars, use the -supp parameter or answer "No" at the first message box. ---------- (total run time: 55 seconds, including 9 seconds for message boxes)

Właśnie zauważyłem że pojawiły się 2 nowe procesy:

Kod: Zaznacz wszystko: D:\Windows\system32\wbem\wmiprvse.exe

co to jest?

**Posty:** 4043 · przez **prog** 14 Maj 2006, 11:07

cinek2007 napisał(a):D:\Windows\system32\wbem\wmiprvse.exe

prawidlowe
Process File: wmiprvse or wmiprvse.exe
Process Name: Microsoft Windows Management Instrumentation

w hijacku widze ze jest ok ale niepokoji mnie to:

Red napisał(a):O4 - HKCU\..\Run: [Mmm] "D:\Program Files\HACE\Mmm\Mmm.exe"

przez **Tom@szek** 14 Maj 2006, 11:12

$prog$ napisał(a):O4 - HKCU\..\Run: [Mmm] "D:\Program Files\HACE\Mmm\Mmm.exe"

Ten wpis zostaw. Jest OK.

prosze o sprawdzenie loga.

Prosze o sprawdzenie loga.

Kto jest na forum