prosze o sprawdzenie loga

**Posty:** 8694 · przez **Red** 30 Gru 2005, 19:48

prosze jeszcze wykonac to:

otwierasz link>>> http://www.silentrunners.org/Silent%20Runners.vbs >>zapisujesz jako na pulpicie>>klikasz dwa razy >>masz wybor i wybierasz no>>i czekasz troszke az wygeneruje sie cały log do konca
wrzucasz na forum

TomaszeQ mi sprawdzal loga do wywalilem jakis skladnik ActiveX bo mi kazal....

>>>Tomasz nie sprawdzał ci loga ....

**Posty:** 43 · przez **kermit_666** 30 Gru 2005, 20:54

Red napisał(a):TomaszeQ mi sprawdzal loga do wywalilem jakis skladnik ActiveX bo mi kazal....

sorki moze sam cos wywalilem niepotrzebnie...

to ten log:

"Silent Runners.vbs", revision 41, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Gadu-Gadu" = ""D:\Program Files\Gadu-Gadu\gg.exe" /tray" ["sms-express.com"]
"CursorXP" = "D:\Program Files\CursorXP\CursorXP.exe" [" "]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"HP Software Update" = "D:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [null data]
"HPDJ Taskbar Utility" = "D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe" ["HP"]
"DeviceDiscovery" = "D:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"]
"ATIPTA" = ""D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]
"NeroFilterCheck" = "D:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"TkBellExe" = ""D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"SunJavaUpdateSched" = "D:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" ["Sun Microsystems, Inc."]
"DownloadAccelerator" = "D:\PROGRA~1\DAP\DAP.EXE /STARTUP" [file not found]
"ISUSPM Startup" = "D:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup" ["InstallShield Software Corporation"]
"ISUSScheduler" = ""D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start" ["InstallShield Software Corporation"]
"Anti-Blaxx Manager" = "D:\Program Files\Anti-Blaxx\Anti-Blaxx.exe" [null data]
"WinampAgent" = "D:\Program Files\Winamp\winampa.exe" [null data]
"STOPzilla" = (empty string)
"KernelFaultCheck" = "D:\WINDOWS\system32\dumprep 0 -k" [MS]

**Posty:** 8694 · przez **Red** 30 Gru 2005, 21:06

log jest urwany,musisz poczekac do konca ,az dostaniesz komunikat ze tworzenie loga zostało zakonczone...

**Posty:** 43 · przez **kermit_666** 30 Gru 2005, 21:19

aha teraz jest...

"Silent Runners.vbs", revision 41, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Gadu-Gadu" = ""D:\Program Files\Gadu-Gadu\gg.exe" /tray" ["sms-express.com"]
"CursorXP" = "D:\Program Files\CursorXP\CursorXP.exe" [" "]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"HP Software Update" = "D:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [null data]
"HPDJ Taskbar Utility" = "D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe" ["HP"]
"DeviceDiscovery" = "D:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"]
"ATIPTA" = ""D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]
"NeroFilterCheck" = "D:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"TkBellExe" = ""D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"SunJavaUpdateSched" = "D:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" ["Sun Microsystems, Inc."]
"DownloadAccelerator" = "D:\PROGRA~1\DAP\DAP.EXE /STARTUP" [file not found]
"ISUSPM Startup" = "D:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup" ["InstallShield Software Corporation"]
"ISUSScheduler" = ""D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start" ["InstallShield Software Corporation"]
"Anti-Blaxx Manager" = "D:\Program Files\Anti-Blaxx\Anti-Blaxx.exe" [null data]
"WinampAgent" = "D:\Program Files\Winamp\winampa.exe" [null data]
"STOPzilla" = (empty string)
"KernelFaultCheck" = "D:\WINDOWS\system32\dumprep 0 -k" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {CLSID}\InProcServer32\(Default) = "D:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {CLSID}\InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
-> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {CLSID}\InProcServer32\(Default) = "D:\WINDOWS\System32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {CLSID}\InProcServer32\(Default) = "D:\WINDOWS\System32\Audiodev.dll" [MS]
"{618F028E-3158-48E1-9E6F-8A915F75F03E}" = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "D:\WINDOWS\system32\dtvxdec_0407.dll" [file not found]
"{CA0ABE1C-48D0-4074-B0B3-3A7DC0D1208D}" = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "D:\WINDOWS\system32\dpvxdec_0411.dll" [file not found]
"{E9EC93CD-6121-4E57-B746-16E5ED825D6A}" = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "D:\WINDOWS\system32\guard.tmp" [file not found]
"{0C495C2D-5037-4117-AF89-EC9442786A20}" = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "D:\WINDOWS\system32\dxvxdec_040c.dll" [file not found]
"{C18C0ACA-1FD7-4FE7-A428-A12EF4D66193}" = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "D:\WINDOWS\system32\NATWMVFile.dll" [file not found]
"{81965CCF-ACB2-4917-9A06-02F721581CB8}" = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "D:\WINDOWS\system32\rHsrad.dll" [file not found]
"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}" = "Webroot Spy Sweeper Context Menu Integration"
-> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard"
-> {CLSID}\InProcServer32\(Default) = "D:\Program Files\ewido anti-malware\shellhook.dll" ["TODO: <Firmenname>"]

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e SsiEfr.e" [file not found], [MS], [file not found], [file not found], [file not found]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! WRNotifier\DLLName = "WRLogonNTF.dll" ["Webroot Software, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
-> {CLSID}\InProcServer32\(Default) = "D:\Program Files\ewido anti-malware\context.dll" ["ewido networks"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
-> {CLSID}\InProcServer32\(Default) = "D:\Program Files\ewido anti-malware\context.dll" ["ewido networks"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
SpySweeper\(Default) = "{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"
-> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "D:\Documents and Settings\i_see_u_drown\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "D:\WINDOWS\System32\logon.scr" [MS]

**Posty:** 8694 · przez **Red** 30 Gru 2005, 21:25

I tak urwałes koncowke ,ale ona juz nie jest istotna....

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e SsiEfr.e" [file not found], [MS], [file not found], [file not found], [file not found]

wykonaj:
Start >>> Uruchom >>> wpisz regedit i przejdz do klucza HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager Tam kliknij podwójnie na wartość BootExecute i z okienka usun wszystko z wyjątkiem autocheck autochk *.

**Posty:** 43 · przez **kermit_666** 30 Gru 2005, 22:21

done

[ Dodano: Dzisiaj o 23:40 ]

Red napisał(a):wykonaj:
Start >>> Uruchom >>> wpisz regedit i przejdz do klucza HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager Tam kliknij podwójnie na wartość BootExecute i z okienka usun wszystko z wyjątkiem autocheck autochk *.

prosze o sprawdzenie loga

Kto jest na forum