proszę o sprawdzenie loga

**Posty:** 190 · przez **servitor** 11 Kwi 2007, 11:47

Witam. Od kilku dni mam poważny problem z kompem. Mianowicie chyba jakaś infekcja go zaatakowała, ponieważ są to typowe objawy wirusa. Mam około 50 procesów [czasem więcej, czasem mniej]. W programie autoconnect pokazuje mi, ze mam polaczenie ale internet nie działa. Jak chce kliknac na ikonke polaczenia internetowego, to pojawia sie ona na ułamek sekundy i znika. svchost.exe przeważnie zajmuje 100% wykorzystania proca. Po zainstalowaniu aktualizacji automatycznych problem ustał na 1 dzień lecz teraz znowu to samo.

Antywirus nic nie wykrył.
Oto logi:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 11:35:14, on 2007-04-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\Explorer.EXE E:\WINDOWS\system32\spoolsv.exe E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe E:\Program Files\Alwil Software\Avast4\ashServ.exe E:\WINDOWS\system32\CTsvcCDA.exe E:\Program Files\Common Files\LightScribe\LSSrvc.exe E:\WINDOWS\system32\nvsvc32.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\system32\MsPMSPSv.exe E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe E:\Program Files\Alwil Software\Avast4\ashWebSv.exe E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe E:\Program Files\DAEMON Tools\daemon.exe E:\WINDOWS\SOUNDMAN.EXE E:\Program Files\Java\jre1.5.0_11\bin\jusched.exe E:\Program Files\Lexmark 2300 Series\lxcgmon.exe E:\Program Files\Lexmark 2300 Series\ezprint.exe E:\WINDOWS\system32\rundll32.exe E:\WINDOWS\system32\CTHELPER.EXE E:\WINDOWS\system32\lxcgcoms.exe E:\Program Files\Google\Google Talk\googletalk.exe E:\Program Files\QuickTime\qttask.exe E:\Program Files\iTunes\iTunesHelper.exe E:\WINDOWS\system32\RUNDLL32.EXE E:\Program Files\Konnekt\konnekt.exe E:\Program Files\AutoConnect\AutoConnect.exe E:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe E:\Program Files\Nikon\PictureProject\NkbMonitor.exe E:\Program Files\iPod\bin\iPodService.exe E:\WINDOWS\system32\wuauclt.exe E:\Program Files\Opera\Opera.exe E:\WINDOWS\system32\wuauclt.exe E:\Documents and Settings\rudy\Pulpit\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - E:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - E:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - E:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKLM\..\Run: [LXCGCATS] rundll32 E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [lxcgmon.exe] "E:\Program Files\Lexmark 2300 Series\lxcgmon.exe" O4 - HKLM\..\Run: [EzPrint] "E:\Program Files\Lexmark 2300 Series\ezprint.exe" O4 - HKLM\..\Run: [FaxCenterServer] "E:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] E:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Jet Detection] "F:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" O4 - HKLM\..\Run: [googletalk] E:\Program Files\Google\Google Talk\googletalk.exe /autostart O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NeroFilterCheck] E:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [Konnekt] "E:\Program Files\Konnekt\konnekt.exe" /autostart O4 - HKCU\..\Run: [Steam] "G:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [AutoConnect] E:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [MsnMsgr] "E:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: DSLMON.lnk = E:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: NkbMonitor.exe.lnk = E:\Program Files\Nikon\PictureProject\NkbMonitor.exe O8 - Extra context menu item: &Windows Live Search - res://E:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: In neuer Registerkarte im Hintergrund öffnen - res://E:\Program Files\Windows Live Toolbar\Components\de-de\msntabres.dll.mui/229?c4a97c1f87d244b38b709db33de2aa2d O8 - Extra context menu item: In neuer Registerkarte im Vordergrund öffnen - res://E:\Program Files\Windows Live Toolbar\Components\de-de\msntabres.dll.mui/230?c4a97c1f87d244b38b709db33de2aa2d O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{1846E531-98AD-402A-A04A-42AE98C2A665}: NameServer = 213.241.79.37 83.238.255.76 O17 - HKLM\System\CS2\Services\Tcpip\..\{1846E531-98AD-402A-A04A-42AE98C2A665}: NameServer = 213.241.79.37 83.238.255.76 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - E:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - E:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: lxcg_device - - E:\WINDOWS\system32\lxcgcoms.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe

Silent Runners:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "Konnekt" = ""E:\Program Files\Konnekt\konnekt.exe" /autostart" ["Stamina"] "Steam" = ""G:\Program Files\Steam\Steam.exe" -silent" ["Valve Corporation"] "AutoConnect" = "E:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"] "MsnMsgr" = ""E:\Program Files\MSN Messenger\MsnMsgr.Exe" /background" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "avast!" = "E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data] "DAEMON Tools" = ""E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "SunJavaUpdateSched" = ""E:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"" ["Sun Microsystems, Inc."] "LXCGCATS" = "rundll32 E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16" [MS] "lxcgmon.exe" = ""E:\Program Files\Lexmark 2300 Series\lxcgmon.exe"" ["Lexmark International, Inc."] "EzPrint" = ""E:\Program Files\Lexmark 2300 Series\ezprint.exe"" ["Lexmark International Inc."] "FaxCenterServer" = ""E:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s" [null data] "BluetoothAuthenticationAgent" = "rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent" [MS] "CTHelper" = "CTHELPER.EXE" ["Creative Technology Ltd"] "UpdReg" = "E:\WINDOWS\UpdReg.EXE" ["Creative Technology Ltd."] "Jet Detection" = ""F:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"" [empty string] "googletalk" = "E:\Program Files\Google\Google Talk\googletalk.exe /autostart" ["Google"] "QuickTime Task" = ""E:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."] "iTunesHelper" = ""E:\Program Files\iTunes\iTunesHelper.exe"" ["Apple Inc."] "NeroFilterCheck" = "E:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" ["Nero AG"] "NvCplDaemon" = "RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "E:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."] {9030D464-4C02-4ABF-8ECC-5164760863C6}\(Default) = (no title provided) -> {HKLM...CLSID} = "Windows Live Sign-in Helper" \InProcServer32\(Default) = "E:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" [MS] {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\(Default) = (no title provided) -> {HKLM...CLSID} = "Windows Live Toolbar Helper" \InProcServer32\(Default) = "E:\Program Files\Windows Live Toolbar\msntb.dll" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "E:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "E:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "E:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "E:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "E:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes" -> {HKLM...CLSID} = "iTunes" \InProcServer32\(Default) = "E:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Inc."] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "E:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "E:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders" -> {HKLM...CLSID} = "Meine freigegebenen Ordner" \InProcServer32\(Default) = "E:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll" [MS] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "E:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "E:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "E:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "E:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "E:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "E:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "E:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "E:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] MyPhoneExplorer\(Default) = "{2D30AAA2-9084-4686-B8B9-B9B62EEFFD4E}" -> {HKLM...CLSID} = "MyPhoneExplorer_ShellEx.ShellExt" \InProcServer32\(Default) = "E:\Program Files\MyPhoneExplorer\DLL\ShellMgr.dll" ["F.J. Wechselberger"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "E:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "E:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "E:\Documents and Settings\rudy\Dane aplikacji\Mozilla\Firefox\Tapeta pulpitu.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "E:\WINDOWS\system32\ssmarque.scr" [MS] Startup items in "rudy" & "All Users" startup folders: ------------------------------------------------------ E:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Reader Speed Launch" -> shortcut to: "E:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] "Adobe Reader Synchronizer" -> shortcut to: "E:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe" [null data] "DSLMON" -> shortcut to: "E:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string] "NkbMonitor.exe" -> shortcut to: "E:\Program Files\Nikon\PictureProject\NkbMonitor.exe" ["Nikon Corporation"] Enabled Scheduled Tasks: ------------------------ "AppleSoftwareUpdate" -> launches: "E:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task" ["Apple Computer, Inc."] "Auf Updates für Windows Live Toolbar prüfen" -> launches: "E:\Program Files\Windows Live Toolbar\MSNTBUP.EXE" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000004\LibraryPath = "%SystemRoot%\system32\wshbth.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 23 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" -> {HKLM...CLSID} = "Windows Live Toolbar" \InProcServer32\(Default) = "E:\Program Files\Windows Live Toolbar\msntb.dll" [MS] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" = (no title provided) -> {HKLM...CLSID} = "Windows Live Toolbar" \InProcServer32\(Default) = "E:\Program Files\Windows Live Toolbar\msntb.dll" [MS] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.5.0_11" \InProcServer32\(Default) = "E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_11" \InProcServer32\(Default) = "E:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "E:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ""E:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data] avast! iAVS4 Control Service, aswUpdSv, ""E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data] avast! Mail Scanner, avast! Mail Scanner, ""E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""E:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] Bluetooth Support Service, BthServ, "E:\WINDOWS\system32\svchost.exe -k bthsvcs" {"E:\WINDOWS\System32\bthserv.dll" [MS]} Creative Service for CDROM Access, Creative Service for CDROM Access, "E:\WINDOWS\system32\CTsvcCDA.exe" ["Creative Technology Ltd"] iPod Service, iPod Service, ""E:\Program Files\iPod\bin\iPodService.exe"" ["Apple Inc."] LightScribeService Direct Disc Labeling Service, LightScribeService, ""E:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] lxcg_device, lxcg_device, "E:\WINDOWS\system32\lxcgcoms.exe -service" [" "] NVIDIA Display Driver Service, NVSvc, "E:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Windows User Mode Driver Framework, UMWdf, "E:\WINDOWS\system32\wdfmgr.exe" [MS] WMDM PMSP Service, WMDM PMSP Service, "E:\WINDOWS\system32\MsPMSPSv.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ 2300 Series Port\Driver = "lxcglmpm.DLL" [" "] Lexmark Print-2-Fax Port\Driver = "LXPRMON.DLL" [null data] Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 76 seconds. ---------- (total run time: 139 seconds)

Za wszelką pomoc dziękuję i pozdrawiam.

**Posty:** 18165 · przez **wojtas** 11 Kwi 2007, 15:53

skasuj:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

start>urchom> wpisz msconfig> zakladka uruchamianie> wylacz progsy ktore nie chcesz zeby startowaly z systemem

daj loga z comboscana:
http://forum.programosy.pl/dodatkowe-narzedzia-do-usuwania-i-ochrony-vt42021.html

Autor postu otrzymał pochwałę

**Posty:** 190 · przez **servitor** 11 Kwi 2007, 18:20

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by rudy on 2007-04-11 at 18:07:55 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created ComboScan Restore Point. -- Last 5 Restore Point(s) -- 12: 2007-04-11 16:08:00 UTC - RP149 - ComboScan Restore Point 11: 2007-04-10 21:40:12 UTC - RP148 - Zainstalowany program DirectX 10: 2007-04-10 17:00:40 UTC - RP147 - Zainstalowany program DirectX 9: 2007-04-10 08:35:55 UTC - RP146 - Software Distribution Service 2.0 8: 2007-04-10 01:00:31 UTC - RP145 - Software Distribution Service 2.0 -- First Restore Point -- 1: 2007-04-03 22:42:24 UTC - RP138 - Punkt kontrolny systemu Performed disk cleanup. -- HijackThis (run as rudy.exe) ------------------------------------------------ Logfile of HijackThis v1.99.1 Scan saved at 18:08:04, on 2007-04-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\Explorer.EXE E:\WINDOWS\system32\spoolsv.exe E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe E:\Program Files\Alwil Software\Avast4\ashServ.exe E:\WINDOWS\system32\CTsvcCDA.exe E:\Program Files\Common Files\LightScribe\LSSrvc.exe E:\WINDOWS\system32\nvsvc32.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\system32\MsPMSPSv.exe E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe E:\Program Files\Alwil Software\Avast4\ashWebSv.exe E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe E:\Program Files\DAEMON Tools\daemon.exe E:\WINDOWS\SOUNDMAN.EXE E:\Program Files\Java\jre1.5.0_11\bin\jusched.exe E:\Program Files\Lexmark 2300 Series\lxcgmon.exe E:\Program Files\Lexmark 2300 Series\ezprint.exe E:\WINDOWS\system32\rundll32.exe E:\WINDOWS\system32\lxcgcoms.exe E:\WINDOWS\system32\CTHELPER.EXE E:\Program Files\Google\Google Talk\googletalk.exe E:\Program Files\QuickTime\qttask.exe E:\Program Files\iTunes\iTunesHelper.exe E:\WINDOWS\system32\RUNDLL32.EXE E:\Program Files\AutoConnect\AutoConnect.exe E:\Program Files\MSN Messenger\MsnMsgr.Exe E:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe E:\Program Files\Nikon\PictureProject\NkbMonitor.exe E:\Program Files\iPod\bin\iPodService.exe E:\WINDOWS\system32\wuauclt.exe E:\Program Files\Konnekt\konnekt.exe G:\programy\comboscan.exe E:\DOCUME~1\rudy\Pulpit\HIJACK~1\rudy.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - E:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - E:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - E:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [LXCGCATS] rundll32 E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] E:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Jet Detection] "F:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" O4 - HKLM\..\Run: [NeroFilterCheck] E:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [MSConfig] E:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [Konnekt] "E:\Program Files\Konnekt\konnekt.exe" /autostart O4 - HKCU\..\Run: [AutoConnect] E:\Program Files\AutoConnect\AutoConnect.exe O4 - Global Startup: DSLMON.lnk = E:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: &Windows Live Search - res://E:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: In neuer Registerkarte im Hintergrund öffnen - res://E:\Program Files\Windows Live Toolbar\Components\de-de\msntabres.dll.mui/229?c4a97c1f87d244b38b709db33de2aa2d O8 - Extra context menu item: In neuer Registerkarte im Vordergrund öffnen - res://E:\Program Files\Windows Live Toolbar\Components\de-de\msntabres.dll.mui/230?c4a97c1f87d244b38b709db33de2aa2d O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{1846E531-98AD-402A-A04A-42AE98C2A665}: NameServer = 213.241.79.37 83.238.255.76 O17 - HKLM\System\CS2\Services\Tcpip\..\{1846E531-98AD-402A-A04A-42AE98C2A665}: NameServer = 213.241.79.37 83.238.255.76 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - E:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - E:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: lxcg_device - - E:\WINDOWS\system32\lxcgcoms.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe -- HijackThis Fixed Entries (E:\DOCUME~1\rudy\Pulpit\HIJACK~1\backups\) -------- backup-20070411-180629-326 O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) -- File Associations ----------------------------------------------------------- .bat - batfile - "%1" %* .chm - chm.file - "E:\WINDOWS\hh.exe" %1 .cmd - cmdfile - "%1" %* .com - comfile - "%1" %* .exe - exefile - "%1" %* .hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1 .inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1 .ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1 .js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %* .lnk - lnkfile - {00021401-0000-0000-C000-000000000046} .pif - piffile - "%1" %* .reg - regfile - regedit.exe "%1" .scr - scrfile - "%1" /S .txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1 .vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- 1R Aavmker4 (avast! Asynchronous Virus Monitor) - E:\WINDOWS\system32\drivers\aavmker4.sys 2S ADILOADER (General Purpose USB Driver (adildr.sys)) - E:\WINDOWS\system32\drivers\adildr.sys 3R adiusbaw (USB ADSL WAN Adapter) - E:\WINDOWS\system32\drivers\adiusbaw.sys 3R ALCXWDM (Service for Realtek AC97 Audio (WDM)) - E:\WINDOWS\system32\drivers\ALCXWDM.SYS 2R aswMon2 (avast! Standard Shield Support) - E:\WINDOWS\system32\drivers\aswmon2.sys 3R aswRdr - E:\WINDOWS\system32\drivers\aswRdr.sys 1R aswTdi (avast! Network Shield Support) - E:\WINDOWS\system32\drivers\aswTdi.sys 1S atitray - E:\Program Files\Radeon Omega Drivers\v3.8.291\ATI Tray Tools\atitray.sys (not found) 3S BthEnum (Sterownik Bluetooth Request Block) - E:\WINDOWS\system32\drivers\BthEnum.sys 3S BTHMODEM (Sterownik komunikacyjny modemu Bluetooth) - E:\WINDOWS\system32\drivers\bthmodem.sys 3S BthPan (Bluetooth Device (Personal Area Network)) - E:\WINDOWS\system32\drivers\bthpan.sys 3S BTHPORT (Sterownik portu Bluetooth) - E:\WINDOWS\system32\drivers\bthport.sys 3S BTHUSB (Sterownik USB odbiornika radiowego Bluetooth) - E:\WINDOWS\system32\drivers\BTHUSB.SYS 3R CA561 (ICatch (VI) PC Camera) - E:\WINDOWS\system32\drivers\SPCA561.SYS 3S CCDECODE (Dekoder napisów) - E:\WINDOWS\system32\drivers\CCDECODE.sys 3R ctac32k (Creative AC3 Software Decoder) - E:\WINDOWS\system32\drivers\CTAC32K.SYS 3R ctaud2k (Creative Audio Driver (WDM)) - E:\WINDOWS\system32\drivers\ctaud2k.sys 3S ctdvda2k (Creative DVD-Audio Device Driver) - E:\WINDOWS\system32\drivers\ctdvda2k.sys (not found) 3S ctljystk (Port gier dla karty Creative SB Live!) - E:\WINDOWS\system32\drivers\ctljystk.sys 3R ctprxy2k (Creative Proxy Driver) - E:\WINDOWS\system32\drivers\CTPRXY2K.SYS 3R ctsfm2k (Creative SoundFont Management Device Driver) - E:\WINDOWS\system32\drivers\CTSFM2K.SYS 3R dtscsi - E:\WINDOWS\system32\drivers\dtscsi.sys 3R emupia (E-mu Plug-in Architecture Driver) - E:\WINDOWS\system32\drivers\EMUPIA2K.SYS 3R FETNDIS (Sterownik NT karty VIA PCI 10/100Mb Fast Ethernet) - E:\WINDOWS\system32\drivers\fetnd5.sys 3R GEARAspiWDM - E:\WINDOWS\system32\drivers\GEARAspiWDM.sys 3S GVCplDrv - E:\WINDOWS\system32\drivers\GVCplDrv.sys 3R ha10kx2k (Creative Hardware Abstract Layer Driver) - E:\WINDOWS\system32\drivers\ha10kx2k.sys 3S hap16v2k (Creative P16V HAL Driver) - E:\WINDOWS\system32\drivers\HAP16V2K.SYS 3S HidBth (Miniport Microsoft Bluetooth HID) - E:\WINDOWS\system32\drivers\hidbth.sys 3R HidUsb (Sterownik Microsoft klasy HID) - E:\WINDOWS\system32\drivers\hidusb.sys 1R intelppm (Sterownik procesora Intel) - E:\WINDOWS\system32\drivers\intelppm.sys 2R irda (Protokół IrDA) - E:\WINDOWS\system32\drivers\irda.sys 3S jswmidin - E:\DOCUME~1\rudy\USTAWI~1\Temp\jswmidin.sys (not found) 3S k750bus (Sony Ericsson 750 driver (WDM)) - E:\WINDOWS\system32\drivers\k750bus.sys 3S k750mdfl (Sony Ericsson 750 USB WMC Modem Filter) - E:\WINDOWS\system32\drivers\k750mdfl.sys 3S k750mdm (Sony Ericsson 750 USB WMC Modem Drivers) - E:\WINDOWS\system32\drivers\k750mdm.sys 3S k750mgmt (Sony Ericsson 750 USB WMC Device Management Drivers) - E:\WINDOWS\system32\drivers\k750mgmt.sys 3S k750obex (Sony Ericsson 750 USB WMC OBEX Interface Drivers) - E:\WINDOWS\system32\drivers\k750obex.sys 1S kbdhid (Sterownik klawiatury HID) - E:\WINDOWS\system32\drivers\kbdhid.sys 3S kxwdmdrv (kX WDM Driver Service) - E:\WINDOWS\system32\drivers\kx.sys (not found) 3S mouhid (Sterownik myszy HID) - E:\WINDOWS\system32\drivers\mouhid.sys 3S MSIRCOMM (Microsoft IR Communications Driver) - E:\WINDOWS\system32\drivers\MSIRCOMM.sys 3S MSTEE (Konwerter strumieni Tee/Sink-to-Sink Microsoft Streaming) - E:\WINDOWS\system32\drivers\MSTEE.sys 3S NABTSFEC (Koder-dekoder NABTS/FEC VBI) - E:\WINDOWS\system32\drivers\NABTSFEC.sys 3S NdisIP (Połączenie TV/wideo firmy Microsoft) - E:\WINDOWS\system32\drivers\NdisIP.sys 3R nv - E:\WINDOWS\system32\drivers\nv4_mini.sys 3R ossrv (Creative OS Services Driver) - E:\WINDOWS\system32\drivers\ctoss2k.sys 2R PfModNT - E:\WINDOWS\system32\drivers\PFMODNT.SYS 3R Rasirda (WAN Miniport (IrDA)) - E:\WINDOWS\system32\drivers\rasirda.sys 3S RFCOMM (Urządzenie Bluetooth (Protokół TDI RFCOMM)) - E:\WINDOWS\system32\drivers\rfcomm.sys 0R sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - E:\WINDOWS\system32\drivers\sfdrv01.sys 0R sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - E:\WINDOWS\system32\drivers\sfhlp02.sys 0R sfsync03 (StarForce Protection Synchronization Driver (version 3.x)) - E:\WINDOWS\system32\drivers\sfsync03.sys 3S SLIP (BDA Slip De-Framer) - E:\WINDOWS\system32\drivers\SLIP.sys 0R sptd - E:\WINDOWS\system32\drivers\sptd.sys 3S STIrUsb (Klucz szyfrujący SigmaTel USB-IrDA) - E:\WINDOWS\system32\drivers\irstusb.sys 3S streamip (BDA IPSink) - E:\WINDOWS\system32\drivers\StreamIP.sys 0R uagp35 (Filtr AGPv3.5 firmy Microsoft) - E:\WINDOWS\system32\drivers\UAGP35.SYS 3R usbccgp (Rodzajowy sterownik nadrzędny USB Microsoft) - E:\WINDOWS\system32\drivers\usbccgp.sys 3R usbehci (Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft) - E:\WINDOWS\system32\drivers\usbehci.sys 3R usbprint (Klasa PRINTER USB Microsoft) - E:\WINDOWS\system32\drivers\usbprint.sys 3R usbscan (Sterownik skanera USB) - E:\WINDOWS\system32\drivers\usbscan.sys 3S usbser (Motorola USB Modem Driver) - E:\WINDOWS\system32\drivers\usbser.sys 3S USBSTOR (Sterownik magazynu masowego USB) - E:\WINDOWS\system32\drivers\USBSTOR.SYS 0R viamraid - E:\WINDOWS\system32\drivers\viamraid.sys 0R videX32 - E:\WINDOWS\system32\drivers\videX32.sys 3S WSTCODEC (Kodery-dekodery teletekstu w standardzie światowym) - E:\WINDOWS\system32\drivers\WSTCODEC.SYS -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- 3S aspnet_state (ASP.NET State Service) - E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 2R aswUpdSv (avast! iAVS4 Control Service) - "E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe" 2R avast! Antivirus - "E:\Program Files\Alwil Software\Avast4\ashServ.exe" 3R avast! Mail Scanner - "E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service 3R avast! Web Scanner - "E:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service 2R BthServ (Bluetooth Support Service) - E:\WINDOWS\system32\svchost.exe -k bthsvcs 3S clr_optimization_v2.0.50727_32 (.NET Runtime Optimization Service v2.0.50727_X86) - E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2R Creative Service for CDROM Access - E:\WINDOWS\system32\CTsvcCDA.exe 3S IDriverT (InstallDriver Table Manager) - "E:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe" 3R iPod Service - "E:\Program Files\iPod\bin\iPodService.exe" 2R Irmon (Monitor podczerwieni) - E:\WINDOWS\system32\svchost.exe -k netsvcs 2R LightScribeService (LightScribeService Direct Disc Labeling Service) - "E:\Program Files\Common Files\LightScribe\LSSrvc.exe" 3R lxcg_device - E:\WINDOWS\system32\lxcgcoms.exe -service 3S MSSQL$SONY_MEDIAMGR - F:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -sSONY_MEDIAMGR 3S MSSQLServerADHelper - E:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe 2R NVSvc (NVIDIA Display Driver Service) - E:\WINDOWS\system32\nvsvc32.exe 3S ose (Office Source Engine) - "E:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" 3S SQLAgent$SONY_MEDIAMGR - F:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -i SONY_MEDIAMGR 2R UMWdf (Windows User Mode Driver Framework) - E:\WINDOWS\system32\wdfmgr.exe 3S usnjsvc (Messenger USN Journal Reader-Service für freigegebene Ordner) - "E:\Program Files\MSN Messenger\usnsvc.exe" 2R WMDM PMSP Service - E:\WINDOWS\system32\MsPMSPSv.exe -- Scheduled Tasks ------------------------------------------------------------- 2007-04-11 17:43:00 252 --a------ E:\WINDOWS\Tasks\Auf Updates für Windows Live Toolbar prüfen.job<AUFUPD~1.JOB> 2007-04-02 10:16:01 284 --a------ E:\WINDOWS\Tasks\AppleSoftwareUpdate.job<APPLES~1.JOB> -- Files created between 2007-03-11 and 2007-04-11 ----------------------------- 2007-04-10 10:46:45 221184 --a------ E:\WINDOWS\system32\wmpns.dll 2007-04-10 03:00:42 0 d-------- E:\WINDOWS\system32\PreInstall<PREINS~1> 2007-04-10 03:00:41 22752 --a------ E:\WINDOWS\system32\spupdsvc.exe 2007-04-10 03:00:39 0 d--h----- E:\WINDOWS\$hf_mig$ 2007-04-09 13:14:55 208896 --a------ E:\WINDOWS\system32\nvudisp.exe 2007-04-09 13:14:55 0 d-------- E:\WINDOWS\nview 2007-04-09 13:14:30 208896 --a------ E:\WINDOWS\system32\NVUNINST.EXE 2007-04-09 12:21:35 0 d-------- E:\WINDOWS\NV5842312.TMP<NV5842~1.TMP> 2007-04-09 12:20:41 0 d-------- E:\NVIDIA 2007-04-09 11:52:11 0 d-------- E:\Program Files\Lavalys 2007-04-09 11:27:15 178408 --a------ E:\WINDOWS\system32\muweb.dll 2007-04-09 11:27:15 128232 --a------ E:\WINDOWS\system32\mucltui.dll 2007-04-09 00:08:12 0 d-------- E:\Program Files\Windows Live Favorites<WI48FA~1> 2007-04-09 00:06:54 0 d-------- E:\Program Files\Windows Live Toolbar<WINDOW~4> 2007-04-09 00:06:08 0 d------c- E:\WINDOWS\system32\DRVSTORE 2007-04-09 00:05:58 0 d-------- E:\Program Files\MSN Messenger<MSNMES~1> 2007-04-08 10:04:20 19039 --a------ E:\WINDOWS\system32\drivers\GVTDrv.sys 2007-04-06 14:54:17 0 d-------- E:\Program Files\Common Files\LightScribe<LIGHTS~1> 2007-04-06 14:51:02 0 d-------- E:\Program Files\Nero 2007-04-06 14:51:02 0 d-------- E:\Program Files\Common Files\Ahead 2007-04-06 14:50:08 0 d-------- E:\WINDOWS\RegisteredPackages<REGIST~2> 2007-04-06 14:18:26 23040 -ra------ E:\WINDOWS\system32\drivers\GVCplDrv.sys 2007-04-02 11:27:14 0 d-------- E:\Program Files\iPod 2007-04-02 11:27:06 0 d-------- E:\Program Files\iTunes 2007-04-02 11:19:41 0 d-------- E:\Program Files\QuickTime<QUICKT~1> 2007-03-28 23:10:19 0 d-------- E:\Program Files\Opera 2007-03-23 23:25:35 0 d-------- E:\Program Files\AutoConnect<AUTOCO~1> 2007-03-21 12:36:37 967 --a------ E:\WINDOWS\ScUnin.pif 2007-03-21 12:36:37 94208 --a------ E:\WINDOWS\ScUnin.exe 2007-03-21 12:36:37 35382 --a------ E:\WINDOWS\scunin.dat 2007-03-18 09:46:01 139264 --a------ E:\WINDOWS\system32\eax.dll 2007-03-18 09:34:39 233472 -ra------ E:\WINDOWS\system32\MafiaSetup.exe<MAFIAS~1.EXE> 2007-03-12 16:58:00 0 d-------- E:\Program Files\Netia -- Find3M Report --------------------------------------------------------------- 2007-04-11 17:58:21 0 d-------- E:\Program Files\Mozilla Firefox 2 Beta 1<MOZILL~1> 2007-04-11 17:49:46 0 d-------- E:\Documents and Settings\rudy\Dane aplikacji\Skype 2007-04-11 17:04:36 288 --a------ E:\WINDOWS\system32\DVCStateBkp-{00000000-00000000-0000000A-00001102-00000002-100A1102}.dat<DVCSTA~2.DAT> 2007-04-11 17:04:36 288 --a------ E:\WINDOWS\system32\DVCState-{00000000-00000000-0000000A-00001102-00000002-100A1102}.dat<DVCSTA~1.DAT> 2007-04-10 18:50:16 0 d-------- E:\Documents and Settings\rudy\Dane aplikacji\uTorrent 2007-04-10 13:35:54 469050 --a------ E:\WINDOWS\system32\perfh015.dat 2007-04-10 13:35:54 83170 --a------ E:\WINDOWS\system32\perfc015.dat 2007-04-10 10:49:37 0 d-------- E:\Program Files\Messenger<MESSEN~1> 2007-04-07 12:41:41 0 d-------- E:\Program Files\SopCast 2007-04-07 12:37:10 0 d-------- E:\Program Files\Neostrada TP<NEOSTR~1> 2007-04-07 12:35:42 0 d-------- E:\Documents and Settings\rudy\Dane aplikacji\Leadertech<LEADER~1> 2007-04-07 00:58:21 0 d-------- E:\Documents and Settings\rudy\Dane aplikacji\Ahead 2007-04-06 14:46:32 0 d-------- E:\Program Files\Ahead 2007-04-06 14:04:16 0 d-------- E:\Documents and Settings\rudy\Dane aplikacji\ATI 2007-03-28 23:10:35 0 d-------- E:\Documents and Settings\rudy\Dane aplikacji\Opera 2007-03-18 09:46:01 0 d-------- E:\Program Files\Creative 2007-03-10 00:08:57 0 d-------- E:\Program Files\SAGEM 2007-03-10 00:08:57 0 d--h----- E:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-03-08 17:38:47 579072 --a------ E:\WINDOWS\system32\user32.dll 2007-03-08 17:38:47 40960 --a------ E:\WINDOWS\system32\mf3216.dll 2007-03-08 17:38:47 281600 --a------ E:\WINDOWS\system32\gdi32.dll 2007-03-08 17:37:33 1843840 --a------ E:\WINDOWS\system32\win32k.sys 2007-03-06 02:05:05 0 d-------- E:\Program Files\Google 2007-02-25 03:13:44 0 d-------- E:\Program Files\Switch Off<SWITCH~1> 2007-02-22 10:17:15 0 d-------- E:\Program Files\Java 2007-02-20 13:18:02 0 d-------- E:\Program Files\IrfanView<IRFANV~1> 2007-02-18 00:14:52 0 d-------- E:\Documents and Settings\rudy\Dane aplikacji\MyPhoneExplorer<MYPHON~1> 2007-02-16 15:30:33 0 d-------- E:\Program Files\Soulseek 2007-02-16 14:48:51 0 d-------- E:\Program Files\Gadu-Gadu<GADU-G~1> 2007-02-14 18:59:10 0 d-------- E:\Program Files\LiveUpdate<LIVEUP~1> 2007-02-14 18:58:58 0 d-------- E:\Program Files\mobile PhoneTools<MOBILE~1> 2007-01-29 10:58:06 60416 -----n--- E:\WINDOWS\system32\tzchange.exe 2007-01-19 12:53:04 51056 --a------ E:\WINDOWS\system32\sirenacm.dll 2007-01-15 19:32:07 689280 --a------ E:\WINDOWS\system32\aswBoot.exe 2007-01-15 19:23:20 90112 --a------ E:\WINDOWS\system32\AVASTSS.scr 2007-01-13 17:55:58 664 --a------ E:\WINDOWS\system32\d3d9caps.dat 2007-01-11 22:46:09 460800 --a------ E:\WINDOWS\snap.dat -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Konnekt"="\"E:\\Program Files\\Konnekt\\konnekt.exe\" /autostart" "AutoConnect"="E:\\Program Files\\AutoConnect\\AutoConnect.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "avast!"="E:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "DAEMON Tools"="\"E:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033" "SoundMan"="SOUNDMAN.EXE" "LXCGCATS"="rundll32 E:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\LXCGtime.dll,_RunDLLEntry@16" "CTHelper"="CTHELPER.EXE" "UpdReg"="E:\\WINDOWS\\UpdReg.EXE" "Jet Detection"="\"F:\\Program Files\\Creative\\SBLive\\PROGRAM\\ADGJDet.exe\"" "NeroFilterCheck"="E:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe" "NvCplDaemon"="RUNDLL32.EXE E:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE E:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "MSConfig"="E:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\E:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] "path"="E:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\Adobe Reader Speed Launch.lnk" "backup"="E:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup" "location"="Common Startup" "command"="E:\\PROGRA~1\\Adobe\\READER~1.0\\Reader\\READER~1.EXE " "item"="Adobe Reader Speed Launch" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\E:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] "path"="E:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\Adobe Reader Synchronizer.lnk" "backup"="E:\\WINDOWS\\pss\\Adobe Reader Synchronizer.lnkCommon Startup" "location"="Common Startup" "command"="E:\\PROGRA~1\\Adobe\\READER~1.0\\Reader\\ADOBEC~1.EXE " "item"="Adobe Reader Synchronizer" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\E:^Documents and Settings^All Users^Menu Start^Programy^Autostart^NkbMonitor.exe.lnk] "path"="E:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\NkbMonitor.exe.lnk" "backup"="E:\\WINDOWS\\pss\\NkbMonitor.exe.lnkCommon Startup" "location"="Common Startup" "command"="E:\\PROGRA~1\\Nikon\\PICTUR~1\\NKBMON~1.EXE " "item"="NkbMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="apdproxy" "hkey"="HKLM" "command"="\"E:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="cli" "hkey"="HKLM" "command"="\"E:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="rundll32" "hkey"="HKLM" "command"="rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ezprint" "hkey"="HKLM" "command"="\"E:\\Program Files\\Lexmark 2300 Series\\ezprint.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="fm3032" "hkey"="HKLM" "command"="\"E:\\Program Files\\Lexmark Fax Solutions\\fm3032.exe\" /s" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="googletalk" "hkey"="HKLM" "command"="E:\\Program Files\\Google\\Google Talk\\googletalk.exe /autostart" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iTunesHelper" "hkey"="HKLM" "command"="\"E:\\Program Files\\iTunes\\iTunesHelper.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="dumprep 0 -k" "hkey"="HKLM" "command"="%systemroot%\\system32\\dumprep 0 -k" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcgmon.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="lxcgmon" "hkey"="HKLM" "command"="\"E:\\Program Files\\Lexmark 2300 Series\\lxcgmon.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"E:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MsnMsgr" "hkey"="HKCU" "command"="\"E:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"E:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Steam" "hkey"="HKCU" "command"="\"G:\\Program Files\\Steam\\Steam.exe\" -silent" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="jusched" "hkey"="HKLM" "command"="\"E:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe\"" "inimapping"="0" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="E:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="E:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1] Source REG_SZ http://www.wp.pl/ [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2] Source REG_SZ http://allegro.pl/item169721192_nowa_nokia_6280_gwarancja_2_lata_wysylka_gratis.html [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 bthsvcs REG_MULTI_SZ BthServ\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H] Shell\AutoRun\command H:\SETUP.EXE -- End of ComboScan: finished at 2007-04-11 at 18:08:38 ------------------------

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by rudy on 2007-04-11 at 18:07:55 Supplementary logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 2.0 Architecture: X86; Language: Polish CPU 0: Intel(R) Celeron(R) CPU 2.80GHz Percentage of Memory in Use: 42% Physical Memory (total/avail): 767.48 MiB / 438.42 MiB Pagefile Memory (total/avail): 1492.14 MiB / 1194.56 MiB Virtual Memory (total/avail): 2047.88 MiB / 1998.81 MiB A: is Removable (Unformatted) D: is CDROM (UDF) E: is Fixed (NTFS) - 10 GiB total, 1.86 GiB free. F: is Fixed (NTFS) - 68.36 GiB total, 4.04 GiB free. G: is Fixed (NTFS) - 70.68 GiB total, 14.18 GiB free. H: is CDROM (CDFS) -- Security Center ------------------------------------------------------------- AUOptions is set to notify before download. Windows Internal Firewall is enabled. -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=E:\Documents and Settings\All Users APPDATA=E:\Documents and Settings\rudy\Dane aplikacji CLASSPATH=.;E:\Program Files\Java\jre1.5.0_11\lib\ext\QTJava.zip CLIENTNAME=Console CommonProgramFiles=E:\Program Files\Common Files COMPUTERNAME=GR ComSpec=E:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=E: HOMEPATH=\Documents and Settings\rudy LOGONSERVER=\\GR NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=E:\WINDOWS\system32;E:\WINDOWS;E:\WINDOWS\System32\Wbem;E:\Program Files\Microsoft SQL Server\80\Tools\Binn\;E:\Program Files\QuickTime\QTSystem\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 3 Stepping 4, GenuineIntel PROCESSOR_LEVEL=15 PROCESSOR_REVISION=0304 ProgramFiles=E:\Program Files PROMPT=$P$G QTJAVA=E:\Program Files\Java\jre1.5.0_11\lib\ext\QTJava.zip SESSIONNAME=Console SystemDrive=E: SystemRoot=E:\WINDOWS TEMP=E:\DOCUME~1\rudy\USTAWI~1\Temp TMP=E:\DOCUME~1\rudy\USTAWI~1\Temp USERDOMAIN=GR USERNAME=rudy USERPROFILE=E:\Documents and Settings\rudy windir=E:\WINDOWS -- User Profiles --------------------------------------------------------------- rudy [I](admin)[/I] -- Add/Remove Programs --------------------------------------------------------- --> "F:\Program Files\Creative\SBLive\Program\Ctzapxx.EXE" /X /U /S --> E:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL --> E:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL --> E:\WINDOWS\UNNeroShowTime.exe /UNINSTALL --> E:\WINDOWS\UNNeroVision.exe /UNINSTALL --> E:\WINDOWS\UNRecode.exe /UNINSTALL --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{435E969D-867E-4364-8E74-3DC8A69C5BDB}\setup.exe" -l0x9 --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{435E969D-867E-4364-8E74-3DC8A69C5BDB}\setup.exe" -l0x9 /remove --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{48E3A9E6-FA13-11D5-8CC9-00A0C98192B6}\setup.exe" -l0x9 --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{48E3A9E6-FA13-11D5-8CC9-00A0C98192B6}\setup.exe" -l0x9 /remove --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{58582977-44D2-44A0-A09B-031CC2AE5938}\setup.exe" -l0x9 --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{58582977-44D2-44A0-A09B-031CC2AE5938}\setup.exe" -l0x9 /remove --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{9A4D2983-4662-4387-BE3D-4CFC2FA9C100}\setup.exe" -l0x9 --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{9A4D2983-4662-4387-BE3D-4CFC2FA9C100}\setup.exe" -l0x9 /remove --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{A731533B-B325-4D9C-91A4-D93C8E294C19}\setup.exe" -l0x9 --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{A731533B-B325-4D9C-91A4-D93C8E294C19}\setup.exe" -l0x9 /remove --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{AC157741-3285-4D6A-B934-9174587A3493}\setup.exe" -l0x9 --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{AC157741-3285-4D6A-B934-9174587A3493}\setup.exe" -l0x9 /remove --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{E7337A45-3FE5-4392-ABBB-26B794D060C9}\setup.exe" -l0x9 --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{E7337A45-3FE5-4392-ABBB-26B794D060C9}\setup.exe" -l0x9 /remove --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{FD851F7E-F887-405D-9E1C-488811113EF3}\setup.exe" -l0x9 --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{FD851F7E-F887-405D-9E1C-488811113EF3}\setup.exe" -l0x9 /remove --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 E:\WINDOWS\INF\PCHealth.inf "SubEdit-Player" --> E:\Program Files\SubEdit-Player\Odinstaluj.exe 18 Wheels of Steel: Haulin' --> G:\Program Files\18 Wheels of Steel Haulin\uninst.exe ABBYY FineReader 6.0 Sprint --> MsiExec.exe /I{ACF60000-22B9-4CE9-98D6-2CCF359BAC07} Adobe Flash Player 9 ActiveX --> E:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete Adobe Reader 8 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A80000000002} Aktualizacja dla systemu Windows XP (KB894391) --> "E:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe" Aktualizacja dla systemu Windows XP (KB898461) --> "E:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe" Aktualizacja dla systemu Windows XP (KB900485) --> "E:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe" Aktualizacja dla systemu Windows XP (KB908531) --> "E:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe" Aktualizacja dla systemu Windows XP (KB910437) --> "E:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe" Aktualizacja dla systemu Windows XP (KB911280) --> "E:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe" Aktualizacja dla systemu Windows XP (KB916595) --> "E:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe" Aktualizacja dla systemu Windows XP (KB920872) --> "E:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe" Aktualizacja dla systemu Windows XP (KB922582) --> "E:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe" Aktualizacja dla systemu Windows XP (KB929338) --> "E:\WINDOWS\$NtUninstallKB929338$\spuninst\spuninst.exe" Aktualizacja dla systemu Windows XP (KB931836) --> "E:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB893756) --> "E:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB896358) --> "E:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB896423) --> "E:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB896428) --> "E:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB899587) --> "E:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB899591) --> "E:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB900725) --> "E:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB901017) --> "E:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB901214) --> "E:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB902400) --> "E:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB904706) --> "E:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB905414) --> "E:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB905749) --> "E:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB908519) --> "E:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB911562) --> "E:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB911927) --> "E:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB913580) --> "E:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB914388) --> "E:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB914389) --> "E:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB917344) --> "E:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB917422) --> "E:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB917953) --> "E:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB918118) --> "E:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB918439) --> "E:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB919007) --> "E:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB920213) --> "E:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB920670) --> "E:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB920683) --> "E:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB920685) --> "E:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB922819) --> "E:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB923191) --> "E:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB923414) --> "E:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB923694) --> "E:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB923980) --> "E:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB924191) --> "E:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB924270) --> "E:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB924496) --> "E:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB924667) --> "E:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB925902) --> "E:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB926255) --> "E:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB926436) --> "E:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB927779) --> "E:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB927802) --> "E:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB928090) --> "E:\WINDOWS\$NtUninstallKB928090$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB928255) --> "E:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB928843) --> "E:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB929969) --> "E:\WINDOWS\$NtUninstallKB929969$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla Windows XP (KB923689) --> "E:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe" Apple Software Update --> MsiExec.exe /I{A50C25D7-62E9-4511-AD70-8E2DA5E79B7D} Archiwizator WinRAR --> E:\Program Files\WinRAR\uninstall.exe ArcSoft Panorama Maker 3 --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{A5F68DC8-0278-4AD8-B413-861509B5F25B}\Setup.exe" -l0x9 AutoConnect v0.1.2.5 --> E:\Program Files\AutoConnect\uninst.exe avast! Antivirus --> rundll32 E:\PROGRA~1\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup Browsen mit Registerkarten (Windows Live Toolbar) --> MsiExec.exe /X{DA2C339B-A405-439B-AD24-07765EF9F233} CCleaner (remove only) --> "E:\Program Files\CCleaner\uninst.exe" CINEMA 4D Release 10 --> E:\WINDOWS\unvise32.exe F:\Program Files\MAXON\CINEMA 4D R10\uninstal_C4D.log Codec Pack - All In 1 6.0.3.0 --> E:\WINDOWS\iun6002.exe "E:\Program Files\Codec Pack - All In 1\irunin.ini" Dawn of War - Dark Crusade --> E:\Program Files\InstallShield Installation Information\{FF39FC01-819B-42E4-AE49-1968AF12DDD4}\setup.exe -runfromtemp -l0x0015 -removeonly DawnOfWar --> E:\PROGRA~1\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe /M{362D5167-9716-44BE-89FD-BF9EB6EF814B} EAX Unified --> E:\WINDOWS\IsUninst.exe -f"E:\Program Files\Creative\EAX Unified\Uninst.isu" Eco Timer 1.0 --> E:\Program Files\Eco Timer\uninst.exe EVEREST Home Edition v2.20 --> "E:\Program Files\Lavalys\EVEREST Home Edition\unins000.exe" Feederkennung (Windows Live Toolbar) --> MsiExec.exe /X{3A75BDE6-418E-4DB9-8601-C9E5225E0059} foobar2000 --> "E:\Program Files\foobar2000\uninstall.exe" Gadu-Gadu 6.1 --> E:\Program Files\Gadu-Gadu\Setup.exe GameDesire-Pool & Snooker --> E:\Program Files\Ganymede\uninstaller.exe Google Talk (remove only) --> "E:\Program Files\Google\Google Talk\uninstall.exe" HijackThis 1.99.1 --> G:\programy\hijackthis\HijackThis.exe /uninstall HLSW v1.1.5 --> "F:\Program Files\HLSW\unins000.exe" ICatch (VI) PC Camera --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{F48C6EA5-3B43-11D6-86A6-0050BA0259A2}\setup.exe" IrfanView (remove only) --> E:\Program Files\IrfanView\iv_uninstall.exe iTunes --> MsiExec.exe /I{AB90749C-7422-4580-8A7A-66CC5E9E5F98} J2SE Runtime Environment 5.0 Update 10 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100} J2SE Runtime Environment 5.0 Update 11 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110} J2SE Runtime Environment 5.0 Update 9 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090} K-Lite Codec Pack --> "E:\Program Files\K-Lite Codec Pack\unins000.exe" Konnekt --> E:\Program Files\Konnekt\Uninst.exe Lexmark 2300 Series --> E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxcgUNST.EXE -NOLICENSE LiveUpdate BVRP Software --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}\Setup.exe" -l0x15 Mafia --> G:\program files\Mafia\MafiaSetup.exe Microsoft Office Professional Edition 2003 --> MsiExec.exe /I{90110415-6000-11D3-8CFE-0150048383C9} Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR) --> MsiExec.exe /X{E09B48B5-E141-427A-AB0C-D3605127224A} mIRC --> "E:\Program Files\mIRC\mirc.exe" -uninstall mobile PhoneTools --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{F18E8A0F-BE99-4305-96A5-6C0FD9D7D999}\setup.exe" -l0x15 Mozilla Firefox (2.0.0.3) --> E:\PROGRA~1\Mozilla Firefox 2 Beta 1\uninstall\helper.exe MultiRes (remove only) --> E:\Program Files\MultiRes\uninstal.exe MyPhoneExplorer --> E:\Program Files\MyPhoneExplorer\uninstall.exe Nero 7 Essentials --> MsiExec.exe /I{8867CEBD-E6C0-4C7A-83B3-9E45669A1045} NET Render Release 10 --> E:\WINDOWS\unvise32.exe F:\Program Files\MAXON\NET Render R10\uninstal_NET.log NETIANET --> E:\Program Files\Netia\Net\netianet.exe -uninstall Nikon FotoShare --> E:\Program Files\Nikon\FotoShare\Uninstal.exe E:\PROGRA~1\Nikon\FOTOSH~1\INSTALL.LOG Nikon Message Center --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\Setup.exe" -l0x9 UNINSTALL NVIDIA Drivers --> E:\WINDOWS\system32\nvudisp.exe UninstallGUI OneCare Advisor (Windows Live Toolbar) --> MsiExec.exe /X{3AF0CCF7-3D25-470A-91D3-ABBBA7F30327} Opera 9.10 --> MsiExec.exe /X{750B9AD1-4C63-4143-94C5-6FB304199BAD} Oprogramowanie faksowe Lexmark --> E:\Program Files\Lexmark Fax Solutions\Install\x86\Uninst.exe PictureProject --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{FF3999BE-1A7B-4738-88AA-97BF14094A4A}\Setup.exe" -l0x9 UNINSTALL Poprawka systemu Windows XP - KB873339 --> E:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe Poprawka systemu Windows XP - KB885835 --> E:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe Poprawka systemu Windows XP - KB885836 --> E:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe Poprawka systemu Windows XP - KB886185 --> E:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe Poprawka systemu Windows XP - KB887472 --> E:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe Poprawka systemu Windows XP - KB888302 --> E:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe Poprawka systemu Windows XP - KB890859 --> "E:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe" Poprawka systemu Windows XP - KB891781 --> E:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe Popupblocker (Windows Live Toolbar) --> MsiExec.exe /X{151ACDE2-C3AC-43AA-A77E-12A5D8B2A934} QuickTime --> MsiExec.exe /I{5E863175-E85D-44A6-8968-82507D34AE7F} Race Driver 3 --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{0297C87B-CC40-446F-865A-031B4FC0CF22}\Setup.exe" -l0x9 -removeonly Realtek AC'97 Audio --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE SAGEM F@st 800-840 --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}\setup.exe" -l0x15 Scarface: The World is Yours --> E:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1150\INTEL3~1\IDriver.exe /M{28142407-ACAD-4ECD-A6B6-9FA8471F6062} Skype 3.0 --> "E:\Program Files\Skype\Phone\unins000.exe" Skype Plugin Manager --> MsiExec.exe /I{3D5E5C0A-5B36-4F98-99A7-287F7DBDCE03} Smart Menus (Windows Live Toolbar) --> MsiExec.exe /X{13AD0F5B-FF8C-4625-851D-A83D4BE74716} Sony Media Manager 2.2 --> MsiExec.exe /X{565286F6-CE28-45D5-A64B-DCDCD3130881} Sony Vegas 7.0 --> MsiExec.exe /X{0E27A421-0701-43D6-B214-D90C92821A7A} SopCast 1.0.1 --> E:\Program Files\SopCast\uninst.exe Sound Blaster Live! --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{9115E7DB-3B29-445A-802D-11E0AA945B7F}\SETUP.EXE" -l0x9 Spybot - Search & Destroy 1.4 --> "E:\Program Files\Spybot - Search & Destroy\unins000.exe" Starcraft --> E:\WINDOWS\SCunin.exe E:\WINDOWS\SCunin.dat Steam --> G:\PROGRA~1\Steam\UNWISE.EXE G:\PROGRA~1\Steam\INSTALL.LOG Switch Off --> "E:\Program Files\Switch Off\uninstall.exe" TeamSpeak 2 RC2 --> "E:\Program Files\Teamspeak2_RC2\unins000.exe" Total Commander (Remove or Repair) --> G:\totalcmd\tcuninst.exe Update Service --> E:\Program Files\Sony Ericsson\Update Service\uninst.exe VIA Platform Device Manager --> E:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169} Video to Flash Converter PRO --> "E:\Program Files\GeoVid\Video to Flash Converter PRO\unins000.exe" VideoLAN VLC media player 0.8.5 --> E:\Program Files\VideoLAN\VLC\uninstall.exe Windows Live Favorites für Windows Live Toolbar --> MsiExec.exe /X{DCE65B11-710D-4C54-9DE5-1A6A0BD2186B} Windows Live Messenger --> MsiExec.exe /I{279DB581-239C-4E13-97F8-0F48E40BE75C} Windows Live Outlook-Toolbar (Windows Live Toolbar) --> MsiExec.exe /X{22B099A6-55E1-4605-8401-05564320101C} Windows Live Sign-in Assistant --> MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7} Windows Live Toolbar-Erweiterung (Windows Live Toolbar) --> MsiExec.exe /X{6266BA75-45FA-4B1A-B21F-E04A90C273E5} Windows Live Toolbar --> "E:\Program Files\Windows Live Toolbar\UnInstall.exe" {28E151E2-A495-4C41-A94C-D3682E10F57E} Windows Live Toolbar --> MsiExec.exe /X{28E151E2-A495-4C41-A94C-D3682E10F57E} Wtyczka CrazyTalk for Skype --> RunDll32 E:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "E:\Program Files\InstallShield Installation Information\{8865B208-4759-4308-8DB5-3C18D2F568E2}\Setup.exe" -l0x15 /uninstall Xfire (remove only) --> "E:\Program Files\Xfire\uninst.exe" -- End of ComboScan: finished at 2007-04-11 at 18:08:38 ------------------------

**Posty:** 18165 · przez **wojtas** 11 Kwi 2007, 20:21

sciagnij:
ATF_Cleaner
http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

skasuj:

E:\WINDOWS\NV5842312.TMP

**Posty:** 190 · przez **servitor** 15 Kwi 2007, 16:59

zadna aplikacja sie nie uruchamia, klikam na ikone, kolo strzalki chwile jest klepsydra i nic sie nie dzieje. tak jest z kazda aplikacja

nie wiem juz od czego to moze byc

[ Dodano: Dzisiaj o 17:25 ]
zauważyłem, ze caly czas mam 100% wykorzystania proca przez svchost.exe, a jak zakoncze ten proces o ile uda mi sie wlaczyc menadzera zadan to nie dziala internet

**Posty:** 18165 · przez **wojtas** 15 Kwi 2007, 19:18

hmm daj nowe logi z hijack this oraz silent runners

**Posty:** 190 · przez **servitor** 16 Kwi 2007, 09:44

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 09:25:16, on 2007-04-16 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\Explorer.EXE E:\WINDOWS\system32\spoolsv.exe E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe E:\Program Files\Alwil Software\Avast4\ashServ.exe E:\WINDOWS\system32\CTsvcCDA.exe E:\Program Files\Common Files\LightScribe\LSSrvc.exe E:\WINDOWS\system32\nvsvc32.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\system32\MsPMSPSv.exe E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe E:\Program Files\Alwil Software\Avast4\ashWebSv.exe E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe E:\Program Files\DAEMON Tools\daemon.exe E:\WINDOWS\SOUNDMAN.EXE E:\WINDOWS\system32\CTHELPER.EXE E:\WINDOWS\system32\RUNDLL32.EXE E:\Program Files\AutoConnect\AutoConnect.exe E:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe E:\PROGRA~1\Mozilla Firefox 2 Beta 1\firefox.exe E:\WINDOWS\system32\wuauclt.exe E:\Program Files\Konnekt\konnekt.exe E:\Program Files\Opera\Opera.exe E:\WINDOWS\system32\wuauclt.exe E:\WINDOWS\system32\taskmgr.exe E:\Documents and Settings\rudy\Pulpit\hijackthis\HijackThis.exe E:\Program Files\Alwil Software\Avast4\setup\avast.setup R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - E:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - E:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - E:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [LXCGCATS] rundll32 E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] E:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Jet Detection] "F:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" O4 - HKLM\..\Run: [NeroFilterCheck] E:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [Konnekt] "E:\Program Files\Konnekt\konnekt.exe" /autostart O4 - HKCU\..\Run: [AutoConnect] E:\Program Files\AutoConnect\AutoConnect.exe O4 - Global Startup: DSLMON.lnk = E:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: &Windows Live Search - res://E:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: In neuer Registerkarte im Hintergrund öffnen - res://E:\Program Files\Windows Live Toolbar\Components\de-de\msntabres.dll.mui/229?c4a97c1f87d244b38b709db33de2aa2d O8 - Extra context menu item: In neuer Registerkarte im Vordergrund öffnen - res://E:\Program Files\Windows Live Toolbar\Components\de-de\msntabres.dll.mui/230?c4a97c1f87d244b38b709db33de2aa2d O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{1846E531-98AD-402A-A04A-42AE98C2A665}: NameServer = 213.241.79.37 83.238.255.76 O17 - HKLM\System\CS2\Services\Tcpip\..\{1846E531-98AD-402A-A04A-42AE98C2A665}: NameServer = 213.241.79.37 83.238.255.76 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - E:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - E:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: lxcg_device - - E:\WINDOWS\system32\lxcgcoms.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "Konnekt" = ""E:\Program Files\Konnekt\konnekt.exe" /autostart" ["Stamina"] "AutoConnect" = "E:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "avast!" = "E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data] "DAEMON Tools" = ""E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "LXCGCATS" = "rundll32 E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16" [MS] "CTHelper" = "CTHELPER.EXE" ["Creative Technology Ltd"] "UpdReg" = "E:\WINDOWS\UpdReg.EXE" ["Creative Technology Ltd."] "Jet Detection" = ""F:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"" [empty string] "NeroFilterCheck" = "E:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" ["Nero AG"] "NvCplDaemon" = "RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "E:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."] {9030D464-4C02-4ABF-8ECC-5164760863C6}\(Default) = (no title provided) -> {HKLM...CLSID} = "Windows Live Sign-in Helper" \InProcServer32\(Default) = "E:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" [MS] {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\(Default) = (no title provided) -> {HKLM...CLSID} = "Windows Live Toolbar Helper" \InProcServer32\(Default) = "E:\Program Files\Windows Live Toolbar\msntb.dll" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "E:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "E:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "E:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "E:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "E:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes" -> {HKLM...CLSID} = "iTunes" \InProcServer32\(Default) = "E:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Inc."] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "E:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "E:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders" -> {HKLM...CLSID} = "Meine freigegebenen Ordner" \InProcServer32\(Default) = "E:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll" [MS] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "E:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "E:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "E:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "E:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "E:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "E:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "E:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "E:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] MyPhoneExplorer\(Default) = "{2D30AAA2-9084-4686-B8B9-B9B62EEFFD4E}" -> {HKLM...CLSID} = "MyPhoneExplorer_ShellEx.ShellExt" \InProcServer32\(Default) = "E:\Program Files\MyPhoneExplorer\DLL\ShellMgr.dll" ["F.J. Wechselberger"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "E:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "E:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "E:\Documents and Settings\rudy\Dane aplikacji\Mozilla\Firefox\Tapeta pulpitu.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "E:\WINDOWS\system32\ssmarque.scr" [MS] Startup items in "rudy" & "All Users" startup folders: ------------------------------------------------------ E:\Documents and Settings\All Users\Menu Start\Programy\Autostart "DSLMON" -> shortcut to: "E:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string] Enabled Scheduled Tasks: ------------------------ "AppleSoftwareUpdate" -> launches: "E:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task" ["Apple Computer, Inc."] "Auf Updates für Windows Live Toolbar prüfen" -> launches: "E:\Program Files\Windows Live Toolbar\MSNTBUP.EXE" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000004\LibraryPath = "%SystemRoot%\system32\wshbth.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 23 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" -> {HKLM...CLSID} = "Windows Live Toolbar" \InProcServer32\(Default) = "E:\Program Files\Windows Live Toolbar\msntb.dll" [MS] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" = (no title provided) -> {HKLM...CLSID} = "Windows Live Toolbar" \InProcServer32\(Default) = "E:\Program Files\Windows Live Toolbar\msntb.dll" [MS] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.5.0_11" \InProcServer32\(Default) = "E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_11" \InProcServer32\(Default) = "E:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "E:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ""E:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data] avast! iAVS4 Control Service, aswUpdSv, ""E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data] avast! Mail Scanner, avast! Mail Scanner, ""E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""E:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] Bluetooth Support Service, BthServ, "E:\WINDOWS\system32\svchost.exe -k bthsvcs" {"E:\WINDOWS\System32\bthserv.dll" [MS]} Creative Service for CDROM Access, Creative Service for CDROM Access, "E:\WINDOWS\system32\CTsvcCDA.exe" ["Creative Technology Ltd"] LightScribeService Direct Disc Labeling Service, LightScribeService, ""E:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] NVIDIA Display Driver Service, NVSvc, "E:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Windows User Mode Driver Framework, UMWdf, "E:\WINDOWS\system32\wdfmgr.exe" [MS] WMDM PMSP Service, WMDM PMSP Service, "E:\WINDOWS\system32\MsPMSPSv.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ 2300 Series Port\Driver = "lxcglmpm.DLL" [" "] Lexmark Print-2-Fax Port\Driver = "LXPRMON.DLL" [null data] Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 111 seconds. ---------- (total run time: 183 seconds)

**Posty:** 18165 · przez **wojtas** 16 Kwi 2007, 15:32

nic w logu nie ma

proszę o sprawdzenie loga

proszę o sprawdzenie loga

Kto jest na forum