prosze o sprawdzenie loga :)

**Posty:** 8079 · przez **kajtekjr** 10 Lis 2007, 20:38

Witam! Cos mi dzisiaj net tragicznie chodzi, jakies alerty outposta ze zabroniono zmiany pliku. Mozecie spojrzec co siedzi w moim kompie :?:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:30:13, on 2007-11-10 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\nvraidservice.exe C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\Program Files\ITE\Smart Guardian\ITESMART.EXE C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Agnitum\Outpost Firewall\outpost.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Opera\Opera.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\System32\wbem\unsecapp.exe D:\Tlen.pl\tlen.exe C:\WINDOWS\system32\taskmgr.exe D:\DVD - FOLDER ROBOCZY! NIE USUWAC!\Usuwanie wirusów\HijackThis 1.99.1\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [amd_dc_opt] "C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.04\RivaTuner.exe" /S O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [AQQ] D:\MOJEDO~1\Natalia\Programy\AQQ\AQQ.exe O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - Startup: Smart Guardian.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Szybkie dostosowywanie programu Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{BE497ED7-FCFD-4F78-8586-5572DA80FC63}: NameServer = 194.204.159.1 217.98.63.164 O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\Admin\USTAWI~1\Temp\hpdj.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 48, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "AutoConnect" = "C:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"] "AlcoholAutomount" = ""C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount" ["Alcohol Soft Development Team"] "AQQ" = "D:\MOJEDO~1\Natalia\Programy\AQQ\AQQ.exe" ["AQQ Sp. z o.o."] "DAEMON Tools Pro Agent" = ""C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"" ["DT Soft Ltd."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"" ["Sun Microsystems, Inc."] "NVRaidService" = "C:\WINDOWS\system32\nvraidservice.exe" ["NVIDIA Corporation"] "CTSysVol" = "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r" ["Creative Technology Ltd"] "P17Helper" = "Rundll32 P17.dll,P17Helper" [MS] "UpdReg" = "C:\WINDOWS\UpdReg.EXE" ["Creative Technology Ltd."] "amd_dc_opt" = ""C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe"" [null data] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "] "Outpost Firewall" = "C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice" ["Agnitum Ltd."] "OutpostFeedBack" = "C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup" ["Agnitum Ltd."] "SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"] "Synchronization Manager" = "C:\WINDOWS\system32\mobsync.exe /logon" [MS] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "RivaTunerStartupDaemon" = ""C:\Program Files\RivaTuner v2.04\RivaTuner.exe" /S" [empty string] "PCSuiteTrayApplication" = "C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup" ["Nokia"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {02478D38-C3F9-4efb-9B51-7695ECA05670}\(Default) = (no title provided) -> {HKLM...CLSID} = "&Yahoo! Toolbar Helper" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References" -> {HKLM...CLSID} = "ShellLink for Application References" \InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS] "{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References" -> {HKLM...CLSID} = "Shell Icon Handler for Application References" \InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS] "{45670FA8-ED97-4F44-BC93-305082590BFB}" = "Microsoft.XPS.Shell.Metadata.1" -> {HKLM...CLSID} = "Windows XPS Document Metadata Handler" \InProcServer32\(Default) = "C:\WINDOWS\System32\XPSSHHDR.DLL" [MS] "{44121072-A222-48f2-A58A-6D9AD51EBBE9}" = "Microsoft.XPS.Shell.Thumbnail.1" -> {HKLM...CLSID} = "Windows XPS Document Thumbnail Handler" \InProcServer32\(Default) = "C:\WINDOWS\System32\XPSSHHDR.DLL" [MS] "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices" -> {HKLM...CLSID} = "Portable Media Devices" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{35786D3C-B075-49b9-88DD-029876E11C01}" = "Portable Devices" -> {HKLM...CLSID} = "Portable Devices" \InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshext.dll" [MS] "{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8}" = "Portable Devices Menu" -> {HKLM...CLSID} = "Portable Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshext.dll" [MS] "{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band" -> {HKLM...CLSID} = "Shell Search Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons" -> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] "{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Folder przesyłania Share-to-Web" -> {HKLM...CLSID} = "Folder przesyłania Share-to-Web" \InProcServer32\(Default) = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}" = "AQQ File Transfer Shell Extension" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "D:\MOJEDO~1\Natalia\AQQ\System\AQQSHE~1.DLL" [file not found] "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes" -> {HKLM...CLSID} = "iTunes" \InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Inc."] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS] "{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "Nokia Phone Browser" -> {HKLM...CLSID} = "Nokia Phone Browser" \InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] AQQFileTransfer\(Default) = "{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "D:\MOJEDO~1\Natalia\AQQ\System\AQQSHE~1.DLL" [file not found] ASW\(Default) = "{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}" -> {HKLM...CLSID} = "Outpost.ASWShellExt Component" \InProcServer32\(Default) = "C:\Program Files\Agnitum\Outpost Firewall\op_shell.dll" ["Agnitum Ltd."] Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}" -> {HKLM...CLSID} = "NeroCoverEdContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] ASW\(Default) = "{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}" -> {HKLM...CLSID} = "Outpost.ASWShellExt Component" \InProcServer32\(Default) = "C:\Program Files\Agnitum\Outpost Firewall\op_shell.dll" ["Agnitum Ltd."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ ASW\(Default) = "{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}" -> {HKLM...CLSID} = "Outpost.ASWShellExt Component" \InProcServer32\(Default) = "C:\Program Files\Agnitum\Outpost Firewall\op_shell.dll" ["Agnitum Ltd."] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Startup items in "Admin" & "All Users" startup folders: ------------------------------------------------------- C:\Documents and Settings\Admin\Menu Start\Programy\Autostart "Smart Guardian" -> shortcut to: "C:\Program Files\ITE\Smart Guardian\ITESMART.EXE" ["ITE Tech. Inc."] Enabled Scheduled Tasks: ------------------------ "AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task" ["Apple Inc."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 12 %SystemRoot%\system32\mswsock.dll [MS], 06 - 09, 13 - 28 %SystemRoot%\system32\rsvpsp.dll [MS], 10 - 11 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" -> {HKLM...CLSID} = "Yahoo! Toolbar" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided) -> {HKLM...CLSID} = "Yahoo! Toolbar" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] Explorer Bars Dormant Explorer Bars in "View, Explorer Bar" menu HKLM\Software\Classes\CLSID\{A1A7E22D-1587-4230-8F16-081C68D21448}\(Default) = "Szybkie dostosowywanie programu" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll" ["Agnitum Ltd."] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_03" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_03" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll" ["Sun Microsystems, Inc."] {44627E97-789B-40D4-B5C2-58BD171129A1}\ "ButtonText" = "Szybkie dostosowywanie programu Outpost Firewall Pro" {E2E2DD38-D088-4134-82B7-F2BA38496583}\ "MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ Missing lines (compared with English-language version): "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = "*a" (unwritable string) -> {HKLM...CLSID} = "Yahoo! Toolbar" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Apple Mobile Device, Apple Mobile Device, ""C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"" ["Apple, Inc."] IviRegMgr, IviRegMgr, "C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe" ["InterVideo"] LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"" [MS] NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Outpost Firewall Service, OutpostFirewall, "C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /service" ["Agnitum Ltd."] ServiceLayer, ServiceLayer, ""C:\Program Files\PC Connectivity Solution\ServiceLayer.exe"" ["Nokia."] StarWind AE Service, StarWindServiceAE, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe" ["Rocket Division Software"] Windows Driver Foundation - User-mode Driver Framework, WudfSvc, "C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup" {"C:\WINDOWS\System32\WUDFSvc.dll" [MS]} Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzsnt08\Driver = "hpzsnt08.dll" ["HP"] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 112 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 11 seconds. ---------- (total run time: 139 seconds)

Kod: Zaznacz wszystko: ComboFix 07-11-08.1 - Admin 2007-11-10 19:36:04.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1429 [GMT 1:00] Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-10-10 to 2007-11-10 ))))))))))))))))))))))))))))))) . 2007-11-10 16:54 <DIR> d-------- C:\UniScan 2007-11-10 10:06 278,984 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2007-11-10 10:06 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2007-11-10 08:46 <DIR> d-------- C:\Program Files\7-Zip 2007-11-10 08:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Pro 2007-11-10 08:45 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\DAEMON Tools Pro 2007-11-10 08:44 <DIR> d-------- C:\Program Files\DAEMON Tools Pro 2007-11-09 07:40 <DIR> d-------- C:\Program Files\SnadBoy's Revelation v2 2007-11-08 15:55 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-11-08 15:55 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2007-11-08 15:55 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-11-08 15:55 22,328 --a------ C:\Documents and Settings\Admin\Dane aplikacji\PnkBstrK.sys 2007-11-08 15:37 <DIR> d-------- C:\Program Files\Universal Extractor 2007-11-08 14:28 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PlayFirst 2007-11-08 14:28 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\PlayFirst 2007-11-07 21:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TERMINAL Studio 2007-11-07 14:33 4,096 --a------ C:\WINDOWS\d3dx.dat 2007-11-06 17:36 <DIR> d-------- C:\WINDOWS\tmp 2007-11-06 15:50 <DIR> d--h----- C:\Documents and Settings\Administrator.DOM-KAJTEK\Ustawienia lokalne 2007-11-06 15:50 <DIR> d-------- C:\Documents and Settings\Administrator.DOM-KAJTEK\Ulubione 2007-11-06 15:50 <DIR> d--h----- C:\Documents and Settings\Administrator.DOM-KAJTEK\Szablony 2007-11-06 15:50 <DIR> d-------- C:\Documents and Settings\Administrator.DOM-KAJTEK\Pulpit 2007-11-06 15:50 <DIR> d-------- C:\Documents and Settings\Administrator.DOM-KAJTEK\Moje dokumenty 2007-11-06 15:50 <DIR> dr------- C:\Documents and Settings\Administrator.DOM-KAJTEK\Menu Start 2007-11-06 15:50 <DIR> dr-h----- C:\Documents and Settings\Administrator.DOM-KAJTEK\Dane aplikacji 2007-11-06 15:49 <DIR> d--h----- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT\Ustawienia lokalne 2007-11-06 15:49 <DIR> d-------- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT\Dane aplikacji 2007-11-06 15:49 <DIR> d--h----- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Ustawienia lokalne 2007-11-06 15:49 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Dane aplikacji 2007-11-03 20:49 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NannyMania 2007-11-03 19:42 <DIR> d-------- C:\Program Files\Zylom Games 2007-11-03 19:42 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Zylom 2007-11-03 19:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Zylom 2007-11-03 17:19 <DIR> d-------- C:\totalcmd 2007-11-03 17:19 545 --a------ C:\WINDOWS\UC.PIF 2007-11-03 17:19 545 --a------ C:\WINDOWS\RAR.PIF 2007-11-03 17:19 545 --a------ C:\WINDOWS\PKZIP.PIF 2007-11-03 17:19 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2007-11-03 17:19 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-11-03 17:19 545 --a------ C:\WINDOWS\LHA.PIF 2007-11-03 17:19 545 --a------ C:\WINDOWS\ARJ.PIF 2007-10-31 15:36 <DIR> d-------- C:\WINDOWS\Sun 2007-10-31 15:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Yahoo! Companion 2007-10-31 15:27 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Yahoo! 2007-10-31 14:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Sandlot Games 2007-10-31 14:00 <DIR> d-------- C:\Program Files\Yahoo! 2007-10-31 14:00 <DIR> d-------- C:\Program Files\Shockwave.com 2007-10-30 17:35 <DIR> d-------- C:\Program Files\WinAVI Video Converter 2007-10-30 15:49 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Hamachi 2007-10-30 15:48 <DIR> d-------- C:\Program Files\Hamachi 2007-10-30 15:48 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-10-30 13:15 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Hewlett-Packard 2007-10-29 16:20 <DIR> d-------- C:\Documents and Settings\Download\Dane aplikacji\Avant Profiles 2007-10-29 16:18 <DIR> d-------- C:\Documents and Settings\Download\Wapster 2007-10-29 12:15 <DIR> d-------- C:\Program Files\mozilla.org 2007-10-29 12:15 <DIR> d-------- C:\Program Files\Common Files\mozilla.org 2007-10-29 12:15 118,784 --a------ C:\WINDOWS\SeaMonkeyUninstall.exe 2007-10-29 12:15 118,784 --a------ C:\WINDOWS\GREUninstall.exe 2007-10-29 12:15 3,457 --a------ C:\WINDOWS\mozver.dat 2007-10-27 02:13 <DIR> d--hs---- C:\WINDOWS\ftpcache 2007-10-26 23:52 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2007-10-26 23:52 <DIR> d-------- C:\Program Files\Common Files\Nokia 2007-10-26 23:29 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Media Player Classic 2007-10-26 22:34 <DIR> d-------- C:\Program Files\Mplayer 2007-10-26 22:32 305,152 --a------ C:\WINDOWS\IsUninst.exe 2007-10-26 13:47 <DIR> d-------- C:\Program Files\CDex_170b2 2007-10-25 20:31 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Pro Cycling Manager 2007 2007-10-25 15:01 <DIR> d-------- C:\Program Files\Paragon Software 2007-10-25 15:01 3,870,720 --a------ C:\WINDOWS\system32\qt-mt323.dll 2007-10-25 15:01 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll 2007-10-25 15:01 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll 2007-10-24 13:56 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\K-Meleon 2007-10-24 07:53 <DIR> d-------- C:\WINDOWS\ShellNew 2007-10-23 20:31 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2007-10-20 16:05 <DIR> d-------- C:\Fraps 2007-10-20 16:05 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-10-20 13:44 <DIR> d-------- C:\Program Files\Common Files\DirectX 2007-10-20 13:44 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\THQ 2007-10-20 13:42 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-10-20 13:15 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\fltk.org 2007-10-19 19:37 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\The Bat! 2007-10-19 13:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems 2007-10-19 13:53 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-10-15 18:46 <DIR> d-------- C:\WINDOWS\system32\AGEIA 2007-10-15 18:45 <DIR> d-------- C:\Program Files\AGEIA Technologies 2007-10-15 07:10 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Thunderbird 2007-10-15 07:10 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Talkback 2007-10-15 07:10 335 --a------ C:\WINDOWS\nsreg.dat 2007-10-14 21:36 <DIR> d-------- C:\Program Files\Gimnazjum klasa 3 - Chemia 2007-10-13 08:13 <DIR> d-------- C:\Program Files\iTunes 2007-10-13 08:13 <DIR> d-------- C:\Program Files\iPod 2007-10-13 08:13 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Apple Computer 2007-10-13 08:12 <DIR> d-------- C:\Program Files\Common Files\Apple 2007-10-13 08:04 <DIR> d-------- C:\Program Files\QuickTime 2007-10-13 08:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2007-10-12 20:18 <DIR> d-------- C:\WINDOWS\pss 2007-10-11 16:14 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\InterVideo 2007-10-11 16:13 <DIR> d-------- C:\Program Files\Apple Software Update 2007-10-11 16:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2007-10-11 16:12 <DIR> d-------- C:\Program Files\InterVideo Information Service . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-10 17:36 --------- d-----w C:\Program Files\AutoConnect 2007-11-10 13:47 --------- d-----w C:\Program Files\Mozilla Thunderbird 2007-11-10 10:06 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-09 20:42 --------- d-----w C:\Program Files\Gadu-Gadu 2007-11-03 22:11 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Vso 2007-10-30 13:25 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\PC Suite 2007-10-26 23:03 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia 2007-10-26 22:52 --------- d-----w C:\Program Files\Nokia 2007-10-19 12:56 --------- d-----w C:\Program Files\Common Files\Adobe 2007-10-15 17:45 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-10-13 20:14 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-10-12 10:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Avant Profiles 2007-10-08 18:12 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Leadertech 2007-10-08 18:03 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\AdobeUM 2007-10-08 18:02 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\AdobeAUM 2007-10-08 12:56 --------- d-----w C:\Program Files\DK 2007-10-08 07:08 --------- d-----w C:\Program Files\Java 2007-10-04 13:27 --------- d-----w C:\Documents and Settings\Download\Dane aplikacji\PC Suite 2007-10-04 13:27 --------- d-----w C:\Documents and Settings\Download\Dane aplikacji\Folder przesyłania Share-to-Web 2007-10-04 13:18 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\PC Suite 2007-10-04 13:18 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Folder przesyłania Share-to-Web 2007-10-04 12:53 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\CyberLink 2007-10-04 11:55 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2007-10-03 17:49 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys 2007-10-03 17:49 47,360 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\pcouffin.sys 2007-10-03 17:49 --------- d-----w C:\Program Files\vso 2007-10-03 17:37 --------- d-----w C:\Program Files\CyberLink 2007-10-03 17:37 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\CyberLink 2007-10-03 17:33 --------- d-----w C:\Program Files\Hewlett-Packard 2007-10-03 17:25 --------- d-----w C:\Program Files\Opera 2007-10-03 17:20 82,380 ----a-w C:\WINDOWS\system32\drivers\AFS2K.SYS 2007-10-03 17:19 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Folder przesyłania Share-to-Web 2007-10-03 17:17 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard 2007-10-03 17:04 --------- d-----w C:\Program Files\DIFX 2007-10-03 17:03 --------- d-----w C:\Program Files\PC Connectivity Solution 2007-10-03 17:03 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations 2007-10-03 16:54 --------- d-----w C:\Program Files\Common Files\LightScribe 2007-10-03 16:52 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nero 2007-10-03 16:51 --------- d-----w C:\Program Files\Common Files\Nero 2007-10-03 16:48 --------- d-----w C:\Program Files\Nero 2007-10-03 16:48 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero 2007-10-03 16:44 --------- d-----w C:\Program Files\UltraISO 2007-10-03 16:44 --------- d-----w C:\Program Files\Common Files\EZB Systems 2007-10-03 16:43 --------- d-----w C:\Program Files\Alcohol Soft 2007-10-03 16:41 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-03 16:41 --------- d-----w C:\Program Files\xp-AntiSpy 2007-10-03 16:40 --------- d-----w C:\Program Files\Winamp 2007-10-03 16:39 --------- d-----w C:\Program Files\RivaTuner v2.04 2007-10-03 16:38 --------- d-----w C:\Program Files\Lavalys 2007-10-03 16:38 --------- d-----w C:\Program Files\HyperSnap 6 2007-10-03 16:33 --------- d-----w C:\Program Files\Thomson 2007-10-03 16:32 --------- d-----w C:\Program Files\Real Alternative 2007-10-03 16:32 --------- d-----w C:\Program Files\Media Player Classic 2007-10-03 16:32 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-10-03 16:31 --------- d-----w C:\Program Files\Avant Browser 2007-10-03 16:30 --------- d-----w C:\Program Files\The Bat! 2007-10-03 16:23 --------- d-----w C:\Program Files\Common Files\Agnitum Shared 2007-10-03 16:23 --------- d-----w C:\Program Files\Agnitum 2007-10-03 16:09 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys 2007-10-03 16:09 298,104 ----a-w C:\WINDOWS\system32\imon.dll 2007-10-03 16:09 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys 2007-10-03 16:04 --------- d-----w C:\Program Files\AMD 2007-10-03 16:02 --------- d-----w C:\Program Files\Creative 2007-10-03 15:57 --------- d-----w C:\Program Files\ITE 2007-10-03 15:49 --------- d-----w C:\Program Files\Common Files\Java 2007-10-03 15:40 --------- d-----w C:\Program Files\MSXML 6.0 2007-10-03 15:40 --------- d-----w C:\Program Files\MSXML 4.0 2007-10-03 15:40 --------- d-----w C:\Program Files\Malicious Software Removal Tool 2007-10-03 15:37 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-10-03 15:32 --------- d-----w C:\Program Files\MSBuild 2007-10-03 15:30 --------- d-----w C:\Program Files\Reference Assemblies 2007-10-03 15:25 --------- d-----w C:\Program Files\HighMAT CD Writing Wizard 2007-10-03 15:23 --------- d-----w C:\Program Files\AutoPatcher 2007-10-03 14:56 --------- d-----w C:\Program Files\microsoft frontpage 2007-10-03 14:54 --------- d-----w C:\Program Files\Usługi online 2007-09-16 23:07 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll 2007-09-16 23:07 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll 2007-09-16 23:07 8,491,008 ----a-w C:\WINDOWS\system32\nvcpl.dll 2007-09-16 23:07 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe 2007-09-16 23:07 6,853,088 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys 2007-09-16 23:07 6,746,112 ----a-w C:\WINDOWS\system32\nvoglnt.dll 2007-09-16 23:07 6,344,704 ----a-w C:\WINDOWS\system32\nvdisps.dll 2007-09-16 23:07 5,783,040 ----a-w C:\WINDOWS\system32\nv4_disp.dll 2007-09-16 23:07 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll 2007-09-16 23:07 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll 2007-09-16 23:07 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe 2007-09-16 23:07 425,984 ----a-w C:\WINDOWS\system32\keystone.exe 2007-09-16 23:07 364,544 ----a-w C:\WINDOWS\system32\nvapi.dll 2007-09-16 23:07 36,864 ----a-w C:\WINDOWS\system32\nvcodins.dll 2007-09-16 23:07 36,864 ----a-w C:\WINDOWS\system32\nvcod.dll 2007-09-16 23:07 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll 2007-09-16 23:07 3,551,232 ----a-w C:\WINDOWS\system32\nvvitvs.dll 2007-09-16 23:07 3,334,144 ----a-w C:\WINDOWS\system32\nvgames.dll 2007-09-16 23:07 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll 2007-09-16 23:07 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll 2007-09-16 23:07 2,371,584 ----a-w C:\WINDOWS\system32\nvwss.dll 2007-09-16 23:07 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll 2007-09-16 23:07 155,716 ----a-w C:\WINDOWS\system32\nvsvc32.exe 2007-09-16 23:07 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe 2007-09-16 23:07 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11] "NVRaidService"="C:\WINDOWS\system32\nvraidservice.exe" [2006-06-01 06:09] "CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 09:51] "P17Helper"="P17.dll" [2005-05-03 12:38 C:\WINDOWS\system32\P17.dll] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 00:00] "amd_dc_opt"="C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe" [2006-06-28 14:42] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 00:07] "nwiz"="nwiz.exe" [2007-09-17 00:07 C:\WINDOWS\system32\nwiz.exe] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-10-03 17:09] "Outpost Firewall"="C:\Program Files\Agnitum\Outpost Firewall\outpost.exe" [2006-08-30 09:46] "OutpostFeedBack"="C:\Program Files\Agnitum\Outpost Firewall\feedback.exe" [2006-09-26 18:36] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 10:38] "Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-03 23:44] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 00:07] "RivaTunerStartupDaemon"="C:\Program Files\RivaTuner v2.04\RivaTuner.exe" [2007-09-15 16:40] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 14:10] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 00:14] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 11:29] "AQQ"="D:\MOJEDO~1\Natalia\Programy\AQQ\AQQ.exe" [2007-02-28 13:18] "DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog C:\Documents and Settings\Admin\Menu Start\Programy\Autostart\ Smart Guardian.lnk - C:\Program Files\ITE\Smart Guardian\ITESMART.EXE [2007-10-03 16:57:10] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programy^Autostart^Adobe Gamma.lnk] path=C:\Documents and Settings\Admin\Menu Start\Programy\Autostart\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] "D:\Moje dokumenty\Natalia\llll\3.0\Apps\apdproxy.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AQQ] D:\MOJEDO~1\Natalia\AQQ\AQQ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe R0 Si3132r5;SiI-3132 SoftRaid 5 Controller;C:\WINDOWS\system32\DRIVERS\Si3132r5.sys R1 SandBox;Outpost Firewall Sandbox Driver;\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\Sandbox.SYS R1 VFILT;Outpost Firewall Kernel Driver;\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\FILTNT.SYS R3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\ADBLOCK.DLL R3 AmdTools;AMD Special Tools Driver;C:\WINDOWS\system32\DRIVERS\AmdTools.sys R3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\ARP.DLL R3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\CONTENT.DLL R3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL R3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL R3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL R3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL R3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL R3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL R3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL R3 P17;Sound Blaster Audigy;C:\WINDOWS\system32\drivers\P17.sys R3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL R3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\PROTECT.DLL R3 RivaTuner32;RivaTuner32;\??\C:\Program Files\RivaTuner v2.04\RivaTuner32.sys R3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\SECRET.DLL R3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS . Contents of the 'Scheduled Tasks' folder "2007-10-13 07:00:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-10 19:37:20 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\zntport] "ImagePath"="\SystemRoot\System32\drivers\zntport.sys" . Completion time: 2007-11-10 19:37:48 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 10 Lis 2007, 20:43

czysto

**Posty:** 237 · przez **Kuba1** 10 Lis 2007, 20:45

Możesz dać screena z tym alertem OutPosta?

**Posty:** 8079 · przez **kajtekjr** 15 Lis 2007, 19:29

Sorrki ze dopiero teraz ale do dzisiaj było wszystko ok..

Tutaj screen o ktory prosiłes:

A po kliknieciu na wyswietl historie jest:

No i logi:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:20:04, on 2007-11-15 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\nvraidservice.exe C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\Program Files\ITE\Smart Guardian\ITESMART.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Agnitum\Outpost Firewall\outpost.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wbem\unsecapp.exe C:\Program Files\Opera\Opera.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe D:\DVD - FOLDER ROBOCZY! NIE USUWAC!\Usuwanie wirusów\HijackThis 1.99.1\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [amd_dc_opt] "C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.04\RivaTuner.exe" /S O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - Startup: Smart Guardian.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Szybkie dostosowywanie programu Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{BE497ED7-FCFD-4F78-8586-5572DA80FC63}: NameServer = 194.204.159.1 217.98.63.164 O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\Admin\USTAWI~1\Temp\hpdj.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 48, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "AutoConnect" = "C:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"] "AlcoholAutomount" = ""C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount" ["Alcohol Soft Development Team"] "DAEMON Tools Pro Agent" = ""C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"" ["DT Soft Ltd."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"" ["Sun Microsystems, Inc."] "NVRaidService" = "C:\WINDOWS\system32\nvraidservice.exe" ["NVIDIA Corporation"] "CTSysVol" = "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r" ["Creative Technology Ltd"] "P17Helper" = "Rundll32 P17.dll,P17Helper" [MS] "amd_dc_opt" = ""C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe"" [null data] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "] "Outpost Firewall" = "C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice" ["Agnitum Ltd."] "OutpostFeedBack" = "C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup" ["Agnitum Ltd."] "SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"] "Synchronization Manager" = "C:\WINDOWS\system32\mobsync.exe /logon" [MS] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "RivaTunerStartupDaemon" = ""C:\Program Files\RivaTuner v2.04\RivaTuner.exe" /S" [empty string] "MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References" -> {HKLM...CLSID} = "ShellLink for Application References" \InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS] "{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References" -> {HKLM...CLSID} = "Shell Icon Handler for Application References" \InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS] "{45670FA8-ED97-4F44-BC93-305082590BFB}" = "Microsoft.XPS.Shell.Metadata.1" -> {HKLM...CLSID} = "Windows XPS Document Metadata Handler" \InProcServer32\(Default) = "C:\WINDOWS\System32\XPSSHHDR.DLL" [MS] "{44121072-A222-48f2-A58A-6D9AD51EBBE9}" = "Microsoft.XPS.Shell.Thumbnail.1" -> {HKLM...CLSID} = "Windows XPS Document Thumbnail Handler" \InProcServer32\(Default) = "C:\WINDOWS\System32\XPSSHHDR.DLL" [MS] "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices" -> {HKLM...CLSID} = "Portable Media Devices" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{35786D3C-B075-49b9-88DD-029876E11C01}" = "Portable Devices" -> {HKLM...CLSID} = "Portable Devices" \InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshext.dll" [MS] "{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8}" = "Portable Devices Menu" -> {HKLM...CLSID} = "Portable Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshext.dll" [MS] "{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band" -> {HKLM...CLSID} = "Shell Search Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons" -> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] "{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Folder przesyłania Share-to-Web" -> {HKLM...CLSID} = "Folder przesyłania Share-to-Web" \InProcServer32\(Default) = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}" = "AQQ File Transfer Shell Extension" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "D:\MOJEDO~1\Natalia\AQQ\System\AQQSHE~1.DLL" [file not found] "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes" -> {HKLM...CLSID} = "iTunes" \InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Inc."] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS] "{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "Nokia Phone Browser" -> {HKLM...CLSID} = "Nokia Phone Browser" \InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] AQQFileTransfer\(Default) = "{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "D:\MOJEDO~1\Natalia\AQQ\System\AQQSHE~1.DLL" [file not found] ASW\(Default) = "{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}" -> {HKLM...CLSID} = "Outpost.ASWShellExt Component" \InProcServer32\(Default) = "C:\Program Files\Agnitum\Outpost Firewall\op_shell.dll" ["Agnitum Ltd."] Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}" -> {HKLM...CLSID} = "NeroCoverEdContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] ASW\(Default) = "{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}" -> {HKLM...CLSID} = "Outpost.ASWShellExt Component" \InProcServer32\(Default) = "C:\Program Files\Agnitum\Outpost Firewall\op_shell.dll" ["Agnitum Ltd."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ ASW\(Default) = "{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}" -> {HKLM...CLSID} = "Outpost.ASWShellExt Component" \InProcServer32\(Default) = "C:\Program Files\Agnitum\Outpost Firewall\op_shell.dll" ["Agnitum Ltd."] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Admin\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "Admin" & "All Users" startup folders: ------------------------------------------------------- C:\Documents and Settings\Admin\Menu Start\Programy\Autostart "Smart Guardian" -> shortcut to: "C:\Program Files\ITE\Smart Guardian\ITESMART.EXE" ["ITE Tech. Inc."] Enabled Scheduled Tasks: ------------------------ "AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task" ["Apple Inc."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 12 %SystemRoot%\system32\mswsock.dll [MS], 06 - 09, 13 - 28 %SystemRoot%\system32\rsvpsp.dll [MS], 10 - 11 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" -> {HKLM...CLSID} = "Yahoo! Toolbar" \InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" [file not found] Explorer Bars Dormant Explorer Bars in "View, Explorer Bar" menu HKLM\Software\Classes\CLSID\{A1A7E22D-1587-4230-8F16-081C68D21448}\(Default) = "Szybkie dostosowywanie programu" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll" ["Agnitum Ltd."] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_03" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_03" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll" ["Sun Microsystems, Inc."] {44627E97-789B-40D4-B5C2-58BD171129A1}\ "ButtonText" = "Szybkie dostosowywanie programu Outpost Firewall Pro" {E2E2DD38-D088-4134-82B7-F2BA38496583}\ "MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Apple Mobile Device, Apple Mobile Device, ""C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"" ["Apple, Inc."] IviRegMgr, IviRegMgr, "C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe" ["InterVideo"] LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"" [MS] NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Outpost Firewall Service, OutpostFirewall, "C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /service" ["Agnitum Ltd."] PnkBstrA, PnkBstrA, "C:\WINDOWS\system32\PnkBstrA.exe" [null data] StarWind AE Service, StarWindServiceAE, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe" ["Rocket Division Software"] Windows Driver Foundation - User-mode Driver Framework, WudfSvc, "C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup" {"C:\WINDOWS\System32\WUDFSvc.dll" [MS]} Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzsnt08\Driver = "hpzsnt08.dll" ["HP"] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 141 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 10 seconds. ---------- (total run time: 168 seconds)

Kod: Zaznacz wszystko: ComboFix 07-11-08.1 - Admin 2007-11-15 18:26:49.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1522 [GMT 1:00] Running from: C:\Documents and Settings\Admin\Pulpit\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\t C:\WINDOWS\t\_REGISTRY_MACHINE_SAM C:\WINDOWS\t\_REGISTRY_MACHINE_SECURITY C:\WINDOWS\t\_REGISTRY_MACHINE_SOFTWARE C:\WINDOWS\t\_REGISTRY_MACHINE_SYSTEM C:\WINDOWS\t\_REGISTRY_USER_.DEFAULT C:\WINDOWS\t\default.bak C:\WINDOWS\t\sam.bak C:\WINDOWS\t\security.bak C:\WINDOWS\t\software.bak C:\WINDOWS\t\system.bak . ((((((((((((((((((((((((( Files Created from 2007-10-15 to 2007-11-15 ))))))))))))))))))))))))))))))) . 2007-11-15 15:46 <DIR> d--h----- C:\Documents and Settings\Administrator.DOM-KAJTEK.000\Ustawienia lokalne 2007-11-15 15:46 <DIR> d-------- C:\Documents and Settings\Administrator.DOM-KAJTEK.000\Ulubione 2007-11-15 15:46 <DIR> d--h----- C:\Documents and Settings\Administrator.DOM-KAJTEK.000\Szablony 2007-11-15 15:46 <DIR> d-------- C:\Documents and Settings\Administrator.DOM-KAJTEK.000\Pulpit 2007-11-15 15:46 <DIR> d-------- C:\Documents and Settings\Administrator.DOM-KAJTEK.000\Moje dokumenty 2007-11-15 15:46 <DIR> dr------- C:\Documents and Settings\Administrator.DOM-KAJTEK.000\Menu Start 2007-11-15 15:46 <DIR> dr-h----- C:\Documents and Settings\Administrator.DOM-KAJTEK.000\Dane aplikacji 2007-11-14 12:07 <DIR> d-------- C:\Program Files\Ontrack 2007-11-13 16:29 <DIR> d-------- C:\UniScan 2007-11-13 15:26 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Emisja 2007-11-13 09:17 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe 2007-11-12 20:00 <DIR> d-------- C:\Program Files\GG Lite 2007-11-12 19:58 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\INTERIAPL 2007-11-12 19:49 <DIR> d-------- C:\Documents and Settings\Admin\GG Lite 2007-11-12 17:48 848 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2007-11-12 17:47 <DIR> d-------- C:\Program Files\Corel 2007-11-10 10:06 278,984 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2007-11-10 10:06 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2007-11-10 08:46 <DIR> d-------- C:\Program Files\7-Zip 2007-11-10 08:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Pro 2007-11-10 08:45 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\DAEMON Tools Pro 2007-11-10 08:44 <DIR> d-------- C:\Program Files\DAEMON Tools Pro 2007-11-09 07:40 <DIR> d-------- C:\Program Files\SnadBoy's Revelation v2 2007-11-08 15:55 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-11-08 15:55 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2007-11-08 15:55 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-11-08 15:55 22,328 --a------ C:\Documents and Settings\Admin\Dane aplikacji\PnkBstrK.sys 2007-11-08 15:37 <DIR> d-------- C:\Program Files\Universal Extractor 2007-11-08 14:28 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PlayFirst 2007-11-08 14:28 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\PlayFirst 2007-11-07 21:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TERMINAL Studio 2007-11-07 14:33 4,096 --a------ C:\WINDOWS\d3dx.dat 2007-11-06 17:36 <DIR> d-------- C:\WINDOWS\tmp 2007-11-06 15:50 <DIR> d--h----- C:\Documents and Settings\Administrator.DOM-KAJTEK\Ustawienia lokalne 2007-11-06 15:50 <DIR> d-------- C:\Documents and Settings\Administrator.DOM-KAJTEK\Ulubione 2007-11-06 15:50 <DIR> d--h----- C:\Documents and Settings\Administrator.DOM-KAJTEK\Szablony 2007-11-06 15:50 <DIR> d-------- C:\Documents and Settings\Administrator.DOM-KAJTEK\Pulpit 2007-11-06 15:50 <DIR> d-------- C:\Documents and Settings\Administrator.DOM-KAJTEK\Moje dokumenty 2007-11-06 15:50 <DIR> dr------- C:\Documents and Settings\Administrator.DOM-KAJTEK\Menu Start 2007-11-06 15:50 <DIR> dr-h----- C:\Documents and Settings\Administrator.DOM-KAJTEK\Dane aplikacji 2007-11-06 15:49 <DIR> d--h----- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT\Ustawienia lokalne 2007-11-06 15:49 <DIR> d-------- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT\Dane aplikacji 2007-11-06 15:49 <DIR> d--h----- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Ustawienia lokalne 2007-11-06 15:49 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Dane aplikacji 2007-11-03 20:49 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NannyMania 2007-11-03 19:42 <DIR> d-------- C:\Program Files\Zylom Games 2007-11-03 19:42 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Zylom 2007-11-03 19:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Zylom 2007-11-03 17:19 <DIR> d-------- C:\totalcmd 2007-11-03 17:19 545 --a------ C:\WINDOWS\UC.PIF 2007-11-03 17:19 545 --a------ C:\WINDOWS\RAR.PIF 2007-11-03 17:19 545 --a------ C:\WINDOWS\PKZIP.PIF 2007-11-03 17:19 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2007-11-03 17:19 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-11-03 17:19 545 --a------ C:\WINDOWS\LHA.PIF 2007-11-03 17:19 545 --a------ C:\WINDOWS\ARJ.PIF 2007-10-31 15:36 <DIR> d-------- C:\WINDOWS\Sun 2007-10-31 15:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Yahoo! Companion 2007-10-31 15:27 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Yahoo! 2007-10-31 14:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Sandlot Games 2007-10-31 14:00 <DIR> d-------- C:\Program Files\Yahoo! 2007-10-31 14:00 <DIR> d-------- C:\Program Files\Shockwave.com 2007-10-30 17:35 <DIR> d-------- C:\Program Files\WinAVI Video Converter 2007-10-30 15:49 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Hamachi 2007-10-30 15:48 <DIR> d-------- C:\Program Files\Hamachi 2007-10-30 15:48 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-10-30 13:15 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Hewlett-Packard 2007-10-29 16:20 <DIR> d-------- C:\Documents and Settings\Download\Dane aplikacji\Avant Profiles 2007-10-29 16:18 <DIR> d-------- C:\Documents and Settings\Download\Wapster 2007-10-29 12:15 <DIR> d-------- C:\Program Files\mozilla.org 2007-10-29 12:15 <DIR> d-------- C:\Program Files\Common Files\mozilla.org 2007-10-29 12:15 118,784 --a------ C:\WINDOWS\SeaMonkeyUninstall.exe 2007-10-29 12:15 118,784 --a------ C:\WINDOWS\GREUninstall.exe 2007-10-29 12:15 3,457 --a------ C:\WINDOWS\mozver.dat 2007-10-27 02:13 <DIR> d--hs---- C:\WINDOWS\ftpcache 2007-10-26 23:52 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2007-10-26 23:52 <DIR> d-------- C:\Program Files\Common Files\Nokia 2007-10-26 23:29 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Media Player Classic 2007-10-26 22:34 <DIR> d-------- C:\Program Files\Mplayer 2007-10-26 22:32 305,152 --a------ C:\WINDOWS\IsUninst.exe 2007-10-26 13:47 <DIR> d-------- C:\Program Files\CDex_170b2 2007-10-25 20:31 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Pro Cycling Manager 2007 2007-10-25 15:01 <DIR> d-------- C:\Program Files\Paragon Software 2007-10-25 15:01 3,870,720 --a------ C:\WINDOWS\system32\qt-mt323.dll 2007-10-25 15:01 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll 2007-10-25 15:01 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll 2007-10-24 13:56 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\K-Meleon 2007-10-24 07:53 <DIR> d-------- C:\WINDOWS\ShellNew 2007-10-23 20:31 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2007-10-20 16:05 <DIR> d-------- C:\Fraps 2007-10-20 16:05 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-10-20 13:44 <DIR> d-------- C:\Program Files\Common Files\DirectX 2007-10-20 13:44 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\THQ 2007-10-20 13:42 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-10-20 13:15 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\fltk.org 2007-10-19 19:37 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\The Bat! 2007-10-19 13:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems 2007-10-19 13:53 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-10-15 18:46 <DIR> d-------- C:\WINDOWS\system32\AGEIA 2007-10-15 18:45 <DIR> d-------- C:\Program Files\AGEIA Technologies . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-15 17:16 --------- d-----w C:\Program Files\AutoConnect 2007-11-14 11:08 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-10 13:47 --------- d-----w C:\Program Files\Mozilla Thunderbird 2007-11-09 20:42 --------- d-----w C:\Program Files\Gadu-Gadu 2007-11-03 22:11 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Vso 2007-11-03 21:06 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Apple Computer 2007-10-30 13:25 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\PC Suite 2007-10-26 23:03 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nokia 2007-10-26 22:52 --------- d-----w C:\Program Files\Nokia 2007-10-19 12:56 --------- d-----w C:\Program Files\Common Files\Adobe 2007-10-15 17:45 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-10-14 20:37 --------- d-----w C:\Program Files\Gimnazjum klasa 3 - Chemia 2007-10-13 20:14 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-10-13 07:13 --------- d-----w C:\Program Files\iTunes 2007-10-13 07:13 --------- d-----w C:\Program Files\iPod 2007-10-13 07:13 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2007-10-13 07:12 --------- d-----w C:\Program Files\Common Files\Apple 2007-10-13 07:04 --------- d-----w C:\Program Files\QuickTime 2007-10-13 07:00 --------- d-----w C:\Program Files\Apple Software Update 2007-10-13 07:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple 2007-10-12 10:50 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Avant Profiles 2007-10-11 15:14 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\InterVideo 2007-10-11 15:12 --------- d-----w C:\Program Files\InterVideo Information Service 2007-10-11 15:12 --------- d-----w C:\Program Files\Common Files\Ulead 2007-10-11 15:07 --------- d-----w C:\Program Files\InterVideo 2007-10-11 15:07 --------- d-----w C:\Program Files\Common Files\InterVideo 2007-10-11 15:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2007-10-08 18:12 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Leadertech 2007-10-08 18:03 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\AdobeUM 2007-10-08 18:02 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\AdobeAUM 2007-10-08 12:56 --------- d-----w C:\Program Files\DK 2007-10-08 07:08 --------- d-----w C:\Program Files\Java 2007-10-04 13:27 --------- d-----w C:\Documents and Settings\Download\Dane aplikacji\PC Suite 2007-10-04 13:27 --------- d-----w C:\Documents and Settings\Download\Dane aplikacji\Folder przesyłania Share-to-Web 2007-10-04 13:18 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\PC Suite 2007-10-04 13:18 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Folder przesyłania Share-to-Web 2007-10-04 12:53 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\CyberLink 2007-10-04 11:55 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2007-10-03 17:49 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys 2007-10-03 17:49 47,360 ----a-w C:\Documents and Settings\Admin\Dane aplikacji\pcouffin.sys 2007-10-03 17:49 --------- d-----w C:\Program Files\vso 2007-10-03 17:37 --------- d-----w C:\Program Files\CyberLink 2007-10-03 17:37 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\CyberLink 2007-10-03 17:33 --------- d-----w C:\Program Files\Hewlett-Packard 2007-10-03 17:25 --------- d-----w C:\Program Files\Opera 2007-10-03 17:20 82,380 ----a-w C:\WINDOWS\system32\drivers\AFS2K.SYS 2007-10-03 17:19 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Folder przesyłania Share-to-Web 2007-10-03 17:17 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard 2007-10-03 17:04 --------- d-----w C:\Program Files\DIFX 2007-10-03 17:03 --------- d-----w C:\Program Files\PC Connectivity Solution 2007-10-03 17:03 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations 2007-10-03 16:54 --------- d-----w C:\Program Files\Common Files\LightScribe 2007-10-03 16:52 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nero 2007-10-03 16:51 --------- d-----w C:\Program Files\Common Files\Nero 2007-10-03 16:48 --------- d-----w C:\Program Files\Nero 2007-10-03 16:48 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero 2007-10-03 16:44 --------- d-----w C:\Program Files\UltraISO 2007-10-03 16:44 --------- d-----w C:\Program Files\Common Files\EZB Systems 2007-10-03 16:43 --------- d-----w C:\Program Files\Alcohol Soft 2007-10-03 16:41 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-03 16:41 --------- d-----w C:\Program Files\xp-AntiSpy 2007-10-03 16:40 --------- d-----w C:\Program Files\Winamp 2007-10-03 16:39 --------- d-----w C:\Program Files\RivaTuner v2.04 2007-10-03 16:38 --------- d-----w C:\Program Files\Lavalys 2007-10-03 16:38 --------- d-----w C:\Program Files\HyperSnap 6 2007-10-03 16:33 --------- d-----w C:\Program Files\Thomson 2007-10-03 16:32 --------- d-----w C:\Program Files\Real Alternative 2007-10-03 16:32 --------- d-----w C:\Program Files\Media Player Classic 2007-10-03 16:32 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-10-03 16:31 --------- d-----w C:\Program Files\Avant Browser 2007-10-03 16:30 --------- d-----w C:\Program Files\The Bat! 2007-10-03 16:23 --------- d-----w C:\Program Files\Common Files\Agnitum Shared 2007-10-03 16:23 --------- d-----w C:\Program Files\Agnitum 2007-10-03 16:09 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys 2007-10-03 16:09 298,104 ----a-w C:\WINDOWS\system32\imon.dll 2007-10-03 16:09 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys 2007-10-03 16:04 --------- d-----w C:\Program Files\AMD 2007-10-03 16:02 --------- d-----w C:\Program Files\Creative 2007-10-03 15:57 --------- d-----w C:\Program Files\ITE 2007-10-03 15:49 --------- d-----w C:\Program Files\Common Files\Java 2007-10-03 15:40 --------- d-----w C:\Program Files\MSXML 6.0 2007-10-03 15:40 --------- d-----w C:\Program Files\MSXML 4.0 2007-10-03 15:40 --------- d-----w C:\Program Files\Malicious Software Removal Tool 2007-10-03 15:37 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-10-03 15:32 --------- d-----w C:\Program Files\MSBuild 2007-10-03 15:30 --------- d-----w C:\Program Files\Reference Assemblies 2007-10-03 15:25 --------- d-----w C:\Program Files\HighMAT CD Writing Wizard 2007-10-03 15:23 --------- d-----w C:\Program Files\AutoPatcher 2007-10-03 14:56 --------- d-----w C:\Program Files\microsoft frontpage 2007-10-03 14:54 --------- d-----w C:\Program Files\Usługi online 2007-09-16 23:07 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll 2007-09-16 23:07 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll 2007-09-16 23:07 8,491,008 ----a-w C:\WINDOWS\system32\nvcpl.dll 2007-09-16 23:07 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe 2007-09-16 23:07 6,853,088 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys 2007-09-16 23:07 6,746,112 ----a-w C:\WINDOWS\system32\nvoglnt.dll 2007-09-16 23:07 6,344,704 ----a-w C:\WINDOWS\system32\nvdisps.dll 2007-09-16 23:07 5,783,040 ----a-w C:\WINDOWS\system32\nv4_disp.dll 2007-09-16 23:07 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll 2007-09-16 23:07 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11] "NVRaidService"="C:\WINDOWS\system32\nvraidservice.exe" [2006-06-01 06:09] "CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 09:51] "P17Helper"="P17.dll" [2005-05-03 12:38 C:\WINDOWS\system32\P17.dll] "amd_dc_opt"="C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe" [2006-06-28 14:42] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 00:07] "nwiz"="nwiz.exe" [2007-09-17 00:07 C:\WINDOWS\system32\nwiz.exe] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-10-03 17:09] "Outpost Firewall"="C:\Program Files\Agnitum\Outpost Firewall\outpost.exe" [2006-08-30 09:46] "OutpostFeedBack"="C:\Program Files\Agnitum\Outpost Firewall\feedback.exe" [2006-09-26 18:36] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 10:38] "Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-03 23:44] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 00:07] "RivaTunerStartupDaemon"="C:\Program Files\RivaTuner v2.04\RivaTuner.exe" [2007-09-15 16:40] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2005-09-28 19:13] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 00:14] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 11:29] "DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog C:\Documents and Settings\Admin\Menu Start\Programy\Autostart\ Smart Guardian.lnk - C:\Program Files\ITE\Smart Guardian\ITESMART.EXE [2007-10-03 16:57:10] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programy^Autostart^Adobe Gamma.lnk] path=C:\Documents and Settings\Admin\Menu Start\Programy\Autostart\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] "D:\Moje dokumenty\Natalia\llll\3.0\Apps\apdproxy.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AQQ] D:\MOJEDO~1\Natalia\Programy\AQQ\AQQ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] C:\WINDOWS\UpdReg.EXE R0 Si3132r5;SiI-3132 SoftRaid 5 Controller;C:\WINDOWS\system32\DRIVERS\Si3132r5.sys R1 SandBox;Outpost Firewall Sandbox Driver;\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\Sandbox.SYS R1 VFILT;Outpost Firewall Kernel Driver;\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\FILTNT.SYS R3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\ADBLOCK.DLL R3 AmdTools;AMD Special Tools Driver;C:\WINDOWS\system32\DRIVERS\AmdTools.sys R3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\ARP.DLL R3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\CONTENT.DLL R3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL R3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL R3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL R3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL R3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL R3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL R3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL R3 P17;Sound Blaster Audigy;C:\WINDOWS\system32\drivers\P17.sys R3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL R3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\PROTECT.DLL R3 RivaTuner32;RivaTuner32;\??\C:\Program Files\RivaTuner v2.04\RivaTuner32.sys R3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\SECRET.DLL R3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4de57782-8fbb-11dc-88e5-000e50139320}] \Shell\AutoRun\command - I:\Race07Launcher.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bd699862-8f60-11dc-88e3-000e50139320}] \Shell\AutoRun\command - H:\AutoRunCD.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bd699877-8f60-11dc-88e3-000e50139320}] \Shell\AutoRun\command - G:\Autorun.exe . Contents of the 'Scheduled Tasks' folder "2007-11-14 06:02:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-15 18:28:21 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-15 18:28:49 . --- E O F ---

[ Dodano: Dzisiaj o 18:40 ]
Doszła nowa rzecz...

Gadu-gadu nie działa..

**Posty:** 18165 · przez **wojtas** 15 Lis 2007, 20:41

wmiprvse.exe= usługa Windows Management Instrumentation Provider Service, podstawowa dla życia Windows a pojawiająca się tylko wtedy gdy potrzebuje tego dany soft na kompie

mozesz skasowac:

O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\Admin\USTAWI~1\Temp\hpdj.exe (file missing)

a co do GG to mi tez nie dziala juz ze 2 godziny (problemy techniczne)

prosze o sprawdzenie loga :)

Prosze o sprawdzenie loga :)

Kto jest na forum