prosze o sprawdzenie loga :)

**Posty:** 8079 · przez **kajtekjr** 28 Lip 2006, 14:29

Witam was po 3 tygodniowej przerwie. Byłem u babci a komp w domq a wraz z nim młodsze siostry i sie zrobił syf. Objawia sie on tym ze wyskakuja co pochwilke jakies okienka z reklamami i priocesor cały czas jes prawie na 100% nawet jak zostawie kompa

Daje logi z HJ i Silent Runners'a i prosze o ich sprawdzenie
Z góry dzieki :!:

==============================
:arrow:

Log z HJ:

Logfile of HijackThis v1.99.1
Scan saved at 14:19:25, on 2006-07-28
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\rundll32.exe
C:\WINDOWS\RmlsaXBpYWs\command.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\htpatch.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\PROGRA~1\MYWEBS~1\bar\8.bin\mwsoemon.exe
C:\Program Files\outlook\outlook.exe
C:\nwnmef_7.exe
C:\dfndref_7.exe
C:\kybrdef_7.exe
C:\Program Files\ipwins\ipwins.exe
C:\Program Files\winupdates\winupdates.exe
C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\taskmgr.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\TClock\TClock.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Common Files\{20B68834-07CF-1045-1020-041021020030}\Update.exe
E:\BitSpirit\BitSpirit.exe
C:\Program Files\Tlen.pl\tlen.exe
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\Documents and Settings\Administrator\Pulpit\hijackthis_199\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\7.bin\MWSSRCAS.DLL
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\8.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\8.bin\mwsoemon.exe
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [winlog] winlog.exe
O4 - HKLM\..\Run: [newname] C:\\nwnmef_7.exe
O4 - HKLM\..\Run: [defender] C:\\dfndref_7.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdef_7.exe
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: [WindowsServicesStartup] C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\svchost.exe 1
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\8.bin\mwsoemon.exe
O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O4 - Global Startup: taskmgr.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxmk045YYPL
O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm
O8 - Extra context menu item: RapidShare-Download - res://C:\Documents and Settings\Administrator\Pulpit\Nowy folder (2)\More RapidShare\more-rapid.exe/RsMenExt.html
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F861EC59-9164-4468-8FA6-FC61736E8094}: NameServer = 194.204.152.34 217.98.63.164
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\r86ulij918o.dll
O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\kldcz2.dll (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RmlsaXBpYWs\command.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

==============================
:arrow:

Log z Silent Runners:

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
"{20B68834-07CF-1045-1020-041021020030}" = ""C:\Program Files\Common Files\{20B68834-07CF-1045-1020-041021020030}\Update.exe" mc-110-12-0000140" [null data]

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"(Default)" = (empty string)
"MyWebSearch Email Plugin" = "C:\PROGRA~1\MYWEBS~1\bar\8.bin\mwsoemon.exe" ["MyWebSearch.com"]
"TClock.exe" = "C:\Program Files\TClock\tclock_install.exe" [null data]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]
"SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"HP Software Update" = "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [null data]
"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" ["HP"]
"DeviceDiscovery" = "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]
"DiskeeperSystray" = ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"" ["Diskeeper Corporation"]
"Logitech Utility" = "LOGI_MWX.EXE" ["Logitech Inc."]
"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]
"DataLayer" = "C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" ["Nokia Mobile Phones Ltd."]
"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [file not found]
"My Web Search Bar" = "rundll32 C:\PROGRA~1\MYWEBS~1\bar\8.bin\MWSBAR.DLL,S" [MS]
"MyWebSearch Email Plugin" = "C:\PROGRA~1\MYWEBS~1\bar\8.bin\mwsoemon.exe" ["MyWebSearch.com"]
"outlook" = "C:\Program Files\outlook\outlook.exe /auto" ["InstallShield Software Corporation"]
"winlog" = "winlog.exe" [null data]
"newname" = "C:\\nwnmef_7.exe" ["erijdf cisjtfgurhbyethb784yue7"]
"defender" = "C:\\dfndref_7.exe" ["/|/\?\?\/|?\?"]
"keyboard" = "C:\\kybrdef_7.exe" ["|||?|||||||???||||"]
"IpWins" = "C:\Program Files\ipwins\ipwins.exe" [null data]
"winupdates" = "C:\Program Files\winupdates\winupdates.exe /auto" ["inno setup"]
"WindowsServicesStartup" = "C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\svchost.exe 1" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
-> {HKLM...CLSID} = "AlcoholShellEx"
\InProcServer32\(Default) = "D:\ALCOHO~2\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Folder przesyłania Share-to-Web"
-> {HKLM...CLSID} = "Folder przesyłania Share-to-Web"
\InProcServer32\(Default) = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"]
"{0A082D00-EC93-11D0-B1E6-80580BC10627}" = "Corel Media Folder Root Menu Handler"
-> {HKLM...CLSID} = "Corel Media Folder Root Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}" = "Folder To Corel Media Folder Menu Handler"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{854AF161-1AE1-11D1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{E856F161-1AE5-11d1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{CDB89701-262F-11D1-AB9C-00C0F00683EB}" = "Corel Media Find Folder"
-> {HKLM...CLSID} = "Corel Media Find Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{F8152501-455F-11D1-B1E6-444553540000}" = "Corel Media Folder Copy Hook Handler"
-> {HKLM...CLSID} = "Corel Media Folder Copy Hook Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{8E524B0D-04F0-11D1-B74A-00A0C90646A4}" = "IconFactTemp.NSIconHandlerFactory"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{A2AC368A-F883-11D0-B745-00A0C90646A4}" = "NSFiltManDll.FiltManCom"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser"
-> {HKLM...CLSID} = "Nokia Phone Browser"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"]
"{FBFE7864-D495-41f0-B7DC-4BB601CC295E}" = "Contact View"
-> {HKLM...CLSID} = "Contact View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\ContactView.dll" ["Nokia"]
"{C0C4375A-5B72-4efe-929D-3B848C3A1E91}" = "Message View"
-> {HKLM...CLSID} = "Message View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll" ["Nokia"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
-> {HKLM...CLSID} = "Moje foldery udostępniania"
\InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.0.0792.00.dll" [MS]
"{229C848C-2C03-4079-BE63-F13477456B27}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\wxdtrace.dll" [null data]
"{CF85F7EA-0029-4D91-A63C-FB9A4463FC5E}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nitui1.dll" [null data]
"{49E73640-405D-4019-90F3-6FB09394F223}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\izaksie.dll" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e" [file not found], [MS], [file not found], [file not found]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! Setup\DLLName = "C:\WINDOWS\system32\r86ulij918o.dll" [null data]
INFECTION WARNING! WebCheck\DLLName = "C:\WINDOWS\system32\kldcz2.dll" [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
FolderToCorelMediaFolder\(Default) = "{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]

Startup items in "Administrator" & "All Users" startup folders:
---------------------------------------------------------------

C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart
"SpeedFan" -> shortcut to: "C:\Program Files\SpeedFan\speedfan.exe" ["Almico Software (www.almico.com)"]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
INFECTION WARNING! "taskmgr.exe" ["Windows Installer"]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 18
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}"
-> {HKLM...CLSID} = "My &Web Search"
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL" ["MyWebSearch.com"]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{86227D9C-0EFE-4F8A-AA55-30386A3F5686}"
-> {HKLM...CLSID} = "YourSiteBar"
\InProcServer32\(Default) = "C:\Program Files\YourSiteBar\ysb.dll" [file not found]
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}"
-> {HKLM...CLSID} = "My &Web Search"
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL" ["MyWebSearch.com"]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar"
-> {HKLM...CLSID} = "FlashGet Bar"
\InProcServer32\(Default) = "C:\PROGRA~1\FLASHGET\fgiebar.dll" ["Amaze Soft"]
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}" = (no title provided)
-> {HKLM...CLSID} = "My &Web Search"
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL" ["MyWebSearch.com"]
"{CBCC61FA-0221-4CCC-B409-CEE865CACA3A}" = (no title provided)
-> {HKLM...CLSID} = "ToolBar888"
\InProcServer32\(Default) = "C:\Program Files\ToolBar888\MyToolBar.dll" [null data]

Explorer Bars

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLM\Software\Classes\CLSID\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}\(Default) = "My Web Search Quick View"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "&FlashGet"
"Exec" = "C:\PROGRA~1\FLASHGET\flashget.exe" ["Amaze Soft"]

Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\

Missing lines (compared with English-language version):
"{00A6FAF6-072E-44cf-8957-5838F569A31D}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\SrchAstt\7.bin\MWSSRCAS.DLL" ["MyWebSearch.com"]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Command Service, cmdService, "C:\WINDOWS\RmlsaXBpYWs\command.exe" [null data]
Diskeeper, Diskeeper, ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe"" ["Diskeeper Corporation"]
ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]
LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
NVIDIA Display Driver Service (Omega 1.6177) (Q), NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
StarWind iSCSI Service, StarWindService, "D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
hpzsnt08\Driver = "hpzsnt08.dll" ["HP"]

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 60 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 31 seconds.
---------- (total run time: 133 seconds)

**Posty:** 8694 · przez **Red** 28 Lip 2006, 18:28

zaczniemy od zasad usuwania:

usuwasz z wylaczonym przywracaniem systemu w xp i w trybie awaryjnym f8

zacznij od pracy z automatami do usuwania,zastosujesz:
http://www.atribune.org/content/view/28/

oraz:
http://siri.urz.free.fr/Fix/SmitfraudFix.php
odpalisz go z opcji 2 i przeskanujesz.Reset kompa i prosze o zestaw nowych logów.

**Posty:** 8079 · przez **kajtekjr** 28 Lip 2006, 19:39

Zrobilem jak kazałes a oto nowe logi:
:arrow:

Log z HJ:

Logfile of HijackThis v1.99.1
Scan saved at 19:28:40, on 2006-07-28
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RmlsaXBpYWs\command.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\htpatch.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\PROGRA~1\MYWEBS~1\bar\8.bin\mwsoemon.exe
C:\Program Files\outlook\outlook.exe
C:\nwnmef_7.exe
C:\dfndref_7.exe
C:\kybrdef_7.exe
C:\Program Files\ipwins\ipwins.exe
C:\Program Files\winupdates\winupdates.exe
C:\Program Files\Common Files\{20B68834-07CF-1045-1020-041021020030}\Update.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\taskmgr.exe
C:\Program Files\TClock\TClock.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\Documents and Settings\Administrator\setup.exe
C:\Documents and Settings\Administrator\Pulpit\hijackthis_199\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\7.bin\MWSSRCAS.DLL
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\8.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\8.bin\mwsoemon.exe
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [winlog] winlog.exe
O4 - HKLM\..\Run: [newname] C:\\nwnmef_7.exe
O4 - HKLM\..\Run: [defender] C:\\dfndref_7.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdef_7.exe
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: [WindowsServicesStartup] C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\svchost.exe 1
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\8.bin\mwsoemon.exe
O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O4 - Global Startup: taskmgr.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxmk045YYPL
O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm
O8 - Extra context menu item: RapidShare-Download - res://C:\Documents and Settings\Administrator\Pulpit\Nowy folder (2)\More RapidShare\more-rapid.exe/RsMenExt.html
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F861EC59-9164-4468-8FA6-FC61736E8094}: NameServer = 194.204.152.34 217.98.63.164
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RmlsaXBpYWs\command.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

=======================================
:arrow:

Log z Silent Runners:

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
"{20B68834-07CF-1045-1020-041021020030}" = ""C:\Program Files\Common Files\{20B68834-07CF-1045-1020-041021020030}\Update.exe" mc-110-12-0000140" [null data]

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"(Default)" = (empty string)
"MyWebSearch Email Plugin" = "C:\PROGRA~1\MYWEBS~1\bar\8.bin\mwsoemon.exe" ["MyWebSearch.com"]
"TClock.exe" = "C:\Program Files\TClock\tclock_install.exe" [null data]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]
"SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"HP Software Update" = "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [null data]
"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" ["HP"]
"DeviceDiscovery" = "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]
"DiskeeperSystray" = ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"" ["Diskeeper Corporation"]
"Logitech Utility" = "LOGI_MWX.EXE" ["Logitech Inc."]
"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]
"DataLayer" = "C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" ["Nokia Mobile Phones Ltd."]
"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [file not found]
"My Web Search Bar" = "rundll32 C:\PROGRA~1\MYWEBS~1\bar\8.bin\MWSBAR.DLL,S" [MS]
"MyWebSearch Email Plugin" = "C:\PROGRA~1\MYWEBS~1\bar\8.bin\mwsoemon.exe" ["MyWebSearch.com"]
"outlook" = "C:\Program Files\outlook\outlook.exe /auto" ["InstallShield Software Corporation"]
"winlog" = "winlog.exe" [null data]
"newname" = "C:\\nwnmef_7.exe" ["erijdf cisjtfgurhbyethb784yue7"]
"defender" = "C:\\dfndref_7.exe" ["/|/\?\?\/|?\?"]
"keyboard" = "C:\\kybrdef_7.exe" ["|||?|||||||???||||"]
"IpWins" = "C:\Program Files\ipwins\ipwins.exe" [null data]
"winupdates" = "C:\Program Files\winupdates\winupdates.exe /auto" ["inno setup"]
"WindowsServicesStartup" = "C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\svchost.exe 1" [file not found]
"MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
-> {HKLM...CLSID} = "AlcoholShellEx"
\InProcServer32\(Default) = "D:\ALCOHO~2\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Folder przesyłania Share-to-Web"
-> {HKLM...CLSID} = "Folder przesyłania Share-to-Web"
\InProcServer32\(Default) = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"]
"{0A082D00-EC93-11D0-B1E6-80580BC10627}" = "Corel Media Folder Root Menu Handler"
-> {HKLM...CLSID} = "Corel Media Folder Root Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}" = "Folder To Corel Media Folder Menu Handler"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{854AF161-1AE1-11D1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{E856F161-1AE5-11d1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{CDB89701-262F-11D1-AB9C-00C0F00683EB}" = "Corel Media Find Folder"
-> {HKLM...CLSID} = "Corel Media Find Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{F8152501-455F-11D1-B1E6-444553540000}" = "Corel Media Folder Copy Hook Handler"
-> {HKLM...CLSID} = "Corel Media Folder Copy Hook Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{8E524B0D-04F0-11D1-B74A-00A0C90646A4}" = "IconFactTemp.NSIconHandlerFactory"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{A2AC368A-F883-11D0-B745-00A0C90646A4}" = "NSFiltManDll.FiltManCom"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser"
-> {HKLM...CLSID} = "Nokia Phone Browser"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"]
"{FBFE7864-D495-41f0-B7DC-4BB601CC295E}" = "Contact View"
-> {HKLM...CLSID} = "Contact View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\ContactView.dll" ["Nokia"]
"{C0C4375A-5B72-4efe-929D-3B848C3A1E91}" = "Message View"
-> {HKLM...CLSID} = "Message View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll" ["Nokia"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
-> {HKLM...CLSID} = "Moje foldery udostępniania"
\InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.0.0792.00.dll" [MS]
"{229C848C-2C03-4079-BE63-F13477456B27}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\oobccp32.dll" [file not found]
"{CF85F7EA-0029-4D91-A63C-FB9A4463FC5E}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nitui1.dll" [file not found]
"{49E73640-405D-4019-90F3-6FB09394F223}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\izaksie.dll" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e" [file not found], [MS], [file not found], [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
FolderToCorelMediaFolder\(Default) = "{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]

Startup items in "Administrator" & "All Users" startup folders:
---------------------------------------------------------------

C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart
"SpeedFan" -> shortcut to: "C:\Program Files\SpeedFan\speedfan.exe" ["Almico Software (www.almico.com)"]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
INFECTION WARNING! "taskmgr.exe" ["Windows Installer"]

Enabled Scheduled Tasks:
------------------------

"At1" -> launches: "C:\DOCUME~1\ADMINI~1\Pulpit\Look2Me-Destroyer.exe /task" ["Atribune.org"]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 18
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}"
-> {HKLM...CLSID} = "My &Web Search"
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL" ["MyWebSearch.com"]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{86227D9C-0EFE-4F8A-AA55-30386A3F5686}"
-> {HKLM...CLSID} = "YourSiteBar"
\InProcServer32\(Default) = "C:\Program Files\YourSiteBar\ysb.dll" [file not found]
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}"
-> {HKLM...CLSID} = "My &Web Search"
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL" ["MyWebSearch.com"]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{CBCC61FA-0221-4CCC-B409-CEE865CACA3A}" = "ToolBar888"
-> {HKLM...CLSID} = "ToolBar888"
\InProcServer32\(Default) = "C:\Program Files\ToolBar888\MyToolBar.dll" [null data]
"{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar"
-> {HKLM...CLSID} = "FlashGet Bar"
\InProcServer32\(Default) = "C:\PROGRA~1\FLASHGET\fgiebar.dll" ["Amaze Soft"]
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}" = "My &Web Search"
-> {HKLM...CLSID} = "My &Web Search"
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL" ["MyWebSearch.com"]

Explorer Bars

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLM\Software\Classes\CLSID\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}\(Default) = "My Web Search Quick View"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "&FlashGet"
"Exec" = "C:\PROGRA~1\FLASHGET\flashget.exe" ["Amaze Soft"]

Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\

Missing lines (compared with English-language version):
"{00A6FAF6-072E-44cf-8957-5838F569A31D}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\SrchAstt\7.bin\MWSSRCAS.DLL" ["MyWebSearch.com"]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Command Service, cmdService, "C:\WINDOWS\RmlsaXBpYWs\command.exe" [null data]
Diskeeper, Diskeeper, ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe"" ["Diskeeper Corporation"]
ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]
LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
NVIDIA Display Driver Service (Omega 1.6177) (Q), NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
StarWind iSCSI Service, StarWindService, "D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
hpzsnt08\Driver = "hpzsnt08.dll" ["HP"]

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 55 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 26 seconds.
---------- (total run time: 117 seconds)

**Posty:** 8694 · przez **Red** 28 Lip 2006, 19:48

widze ze juz jest lepiej,jednak do usuniecia jeszcze:

C:\WINDOWS\RmlsaXBpYWs\command.exe
C:\nwnmef_7.exe
C:\dfndref_7.exe
C:\kybrdef_7.exe
C:\Program Files\ipwins\ipwins.exe
C:\Program Files\winupdates\winupdates.exe
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\taskmgr.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\7.bin\MWSSRCAS.DLL
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\8.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\8.bin\mwsoemon.exe
O4 - HKLM\..\Run: [winlog] winlog.exe
O4 - HKLM\..\Run: [newname] C:\\nwnmef_7.exe
O4 - HKLM\..\Run: [defender] C:\\dfndref_7.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdef_7.exe
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: [WindowsServicesStartup] C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\svchost.exe 1
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\8.bin\mwsoemon.exe
O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
O4 - Global Startup: taskmgr.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxmk045YYPL
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBIniti alSetup1.0.0.15.cab
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RmlsaXBpYWs\command.exe

moze jest tego troszke ,ale do usuniecia spokojnie,wpisy zaznacz w hiajacku i nacisnij fix ,a to co pogrubiłem usuwasz recznie z dysku

dodatkowo wykonaj działanie:

Start >>> Uruchom >>> cmd i wklep zestaw komend:

sc stop cmdService
sc delete cmdService

Restart kompa i prosze o logi do kontroli.

**Posty:** 8079 · przez **kajtekjr** 28 Lip 2006, 20:32

Red napisał(a):Start >>> Uruchom >>> cmd i wklep zestaw komend:

sc stop cmdService
sc delete cmdService

Ta konsola cmd nie chce mi działac bo po jej właczenu powinoo sie pokazac
C:\Documents and Settings\Administrator\ a to sie nie pokazuje. Jest tylko okno z czarna konsola i nic poza tym. Dodatkowo zauwarzyłem ze nie moge otworzyc okna po wcisniecu ctrl+alt+delete. Jedyna rzecza ktora sie poprawila jest to ze procesor nie pracuje caly czas na 100%.
========================================
:arrow:

Log z HJ:

Logfile of HijackThis v1.99.1
Scan saved at 20:22:52, on 2006-07-28
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RmlsaXBpYWs\command.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\htpatch.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\outlook\outlook.exe
C:\Program Files\Common Files\{20B68834-07CF-1045-1020-041021020030}\Update.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\Documents and Settings\Administrator\Pulpit\hijackthis_199\HijackThis.exe

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\8.bin\mwsoemon.exe
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm
O8 - Extra context menu item: RapidShare-Download - res://C:\Documents and Settings\Administrator\Pulpit\Nowy folder (2)\More RapidShare\more-rapid.exe/RsMenExt.html
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{F861EC59-9164-4468-8FA6-FC61736E8094}: NameServer = 194.204.152.34 217.98.63.164
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RmlsaXBpYWs\command.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

========================================
:arrow:

Log z Silent Runners:

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
"{20B68834-07CF-1045-1020-041021020030}" = ""C:\Program Files\Common Files\{20B68834-07CF-1045-1020-041021020030}\Update.exe" mc-110-12-0000140" [null data]

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"(Default)" = (empty string)
"MyWebSearch Email Plugin" = "C:\PROGRA~1\MYWEBS~1\bar\8.bin\mwsoemon.exe" [file not found]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]
"SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"HP Software Update" = "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [null data]
"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" ["HP"]
"DeviceDiscovery" = "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]
"DiskeeperSystray" = ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"" ["Diskeeper Corporation"]
"Logitech Utility" = "LOGI_MWX.EXE" ["Logitech Inc."]
"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]
"DataLayer" = "C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" ["Nokia Mobile Phones Ltd."]
"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [file not found]
"outlook" = "C:\Program Files\outlook\outlook.exe /auto" ["InstallShield Software Corporation"]
"MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
-> {HKLM...CLSID} = "AlcoholShellEx"
\InProcServer32\(Default) = "D:\ALCOHO~2\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Folder przesyłania Share-to-Web"
-> {HKLM...CLSID} = "Folder przesyłania Share-to-Web"
\InProcServer32\(Default) = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"]
"{0A082D00-EC93-11D0-B1E6-80580BC10627}" = "Corel Media Folder Root Menu Handler"
-> {HKLM...CLSID} = "Corel Media Folder Root Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}" = "Folder To Corel Media Folder Menu Handler"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{854AF161-1AE1-11D1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{E856F161-1AE5-11d1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{CDB89701-262F-11D1-AB9C-00C0F00683EB}" = "Corel Media Find Folder"
-> {HKLM...CLSID} = "Corel Media Find Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{F8152501-455F-11D1-B1E6-444553540000}" = "Corel Media Folder Copy Hook Handler"
-> {HKLM...CLSID} = "Corel Media Folder Copy Hook Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{8E524B0D-04F0-11D1-B74A-00A0C90646A4}" = "IconFactTemp.NSIconHandlerFactory"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{A2AC368A-F883-11D0-B745-00A0C90646A4}" = "NSFiltManDll.FiltManCom"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser"
-> {HKLM...CLSID} = "Nokia Phone Browser"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"]
"{FBFE7864-D495-41f0-B7DC-4BB601CC295E}" = "Contact View"
-> {HKLM...CLSID} = "Contact View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\ContactView.dll" ["Nokia"]
"{C0C4375A-5B72-4efe-929D-3B848C3A1E91}" = "Message View"
-> {HKLM...CLSID} = "Message View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll" ["Nokia"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
-> {HKLM...CLSID} = "Moje foldery udostępniania"
\InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.0.0792.00.dll" [MS]
"{229C848C-2C03-4079-BE63-F13477456B27}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\oobccp32.dll" [file not found]
"{CF85F7EA-0029-4D91-A63C-FB9A4463FC5E}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nitui1.dll" [file not found]
"{49E73640-405D-4019-90F3-6FB09394F223}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\izaksie.dll" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e" [file not found], [MS], [file not found], [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
FolderToCorelMediaFolder\(Default) = "{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]

Startup items in "Administrator" & "All Users" startup folders:
---------------------------------------------------------------

C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart
"SpeedFan" -> shortcut to: "C:\Program Files\SpeedFan\speedfan.exe" ["Almico Software (www.almico.com)"]

Enabled Scheduled Tasks:
------------------------

"At1" -> launches: "C:\DOCUME~1\ADMINI~1\Pulpit\Look2Me-Destroyer.exe /task" ["Atribune.org"]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 18
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}"
-> {HKLM...CLSID} = "My &Web Search"
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL" [file not found]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{86227D9C-0EFE-4F8A-AA55-30386A3F5686}"
-> {HKLM...CLSID} = "YourSiteBar"
\InProcServer32\(Default) = "C:\Program Files\YourSiteBar\ysb.dll" [file not found]
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}"
-> {HKLM...CLSID} = "My &Web Search"
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL" [file not found]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar"
-> {HKLM...CLSID} = "FlashGet Bar"
\InProcServer32\(Default) = "C:\PROGRA~1\FLASHGET\fgiebar.dll" ["Amaze Soft"]

Explorer Bars

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLM\Software\Classes\CLSID\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}\(Default) = "My Web Search Quick View"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "&FlashGet"
"Exec" = "C:\PROGRA~1\FLASHGET\flashget.exe" ["Amaze Soft"]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Command Service, cmdService, "C:\WINDOWS\RmlsaXBpYWs\command.exe" [null data]
Diskeeper, Diskeeper, ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe"" ["Diskeeper Corporation"]
ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]
LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
NVIDIA Display Driver Service (Omega 1.6177) (Q), NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
StarWind iSCSI Service, StarWindService, "D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
hpzsnt08\Driver = "hpzsnt08.dll" ["HP"]

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 51 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 22 seconds.
---------- (total run time: 103 seconds)

**Posty:** 8694 · przez **Red** 28 Lip 2006, 20:43

spokojnie ,skasuj jeszcze:

O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\8.bin\mwsoemon.exe

Ta konsola cmd nie chce mi działac

no to zastosujemy stary sprawdzony sposób:sciagnij
http://users.telenet.be/marcvn/tools/delcmdservice.zip
kliknij dwa razy na >>delcmdservice
nastepnie dwa razy na >>delreg.bat

jak zakonczy sie działanie restartujesz kompa i dajesz raz jeszcze logi ...

ps

jesli nie peknie>>>MYWEBS~1

to wykonasz:

otwierasz notatnik windowsa i wklejasz w nim to co ponizej:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"{20B68834-07CF-1045-1020-041021020030}"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MyWebSearch Email Plugin"=-

w notatniku u góry>>>plik zapisz jako>>>Zmienić rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisać pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

**Posty:** 8079 · przez **kajtekjr** 28 Lip 2006, 21:23

Red napisał(a):spokojnie

Czy ja panikuje :?:

A tak powaznie to sciagnałem to:

Red napisał(a):http://users.telenet.be/marcvn/tools/delcmdservice.zip

i zrobilem tak jak kazałes ale konsola nadal nie działa, tak jak ctrl+alt+delete.
==========================

Red napisał(a):skasuj jeszcze:

O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\8.bin\mwsoemon.exe

to juz usunąłem ale dopiero po zastosowaniu

Red napisał(a):otwierasz notatnik windowsa i wklejasz w nim to co ponizej:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"{20B68834-07CF-1045-1020-041021020030}"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MyWebSearch Email Plugin"=-

w notatniku u góry>>>plik zapisz jako>>>Zmienić rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisać pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

Co teraz Red :?:

**Posty:** 18165 · przez **wojtas** 28 Lip 2006, 21:26

poprosimy dwa logi z hijacka i sillenta

**Posty:** 8694 · przez **Red** 28 Lip 2006, 21:26

Co teraz Red

cwaniaku

logi podaj....nie siedze u Ciebie na kolanach

**Posty:** 8079 · przez **kajtekjr** 28 Lip 2006, 21:37

Red napisał(a):logi podaj....

Sorrki nie pomyslałem :oops:

Log z HJ:

Logfile of HijackThis v1.99.1
Scan saved at 21:28:13, on 2006-07-28
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\htpatch.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\outlook\outlook.exe
C:\Program Files\Common Files\{20B68834-07CF-1045-1020-041021020030}\Update.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\Documents and Settings\Administrator\Pulpit\Narzedzia antywirusowe!\hijackthis_199\HijackThis.exe

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm
O8 - Extra context menu item: RapidShare-Download - res://C:\Documents and Settings\Administrator\Pulpit\Nowy folder (2)\More RapidShare\more-rapid.exe/RsMenExt.html
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{F861EC59-9164-4468-8FA6-FC61736E8094}: NameServer = 194.204.152.34 217.98.63.164
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

=========================================

:arrow:

Log z Silent Runners:

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
"{20B68834-07CF-1045-1020-041021020030}" = ""C:\Program Files\Common Files\{20B68834-07CF-1045-1020-041021020030}\Update.exe" mc-110-12-0000140" [null data]

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"(Default)" = (empty string)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]
"SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"HP Software Update" = "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [null data]
"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" ["HP"]
"DeviceDiscovery" = "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]
"DiskeeperSystray" = ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"" ["Diskeeper Corporation"]
"Logitech Utility" = "LOGI_MWX.EXE" ["Logitech Inc."]
"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]
"DataLayer" = "C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" ["Nokia Mobile Phones Ltd."]
"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [file not found]
"outlook" = "C:\Program Files\outlook\outlook.exe /auto" ["InstallShield Software Corporation"]
"MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
-> {HKLM...CLSID} = "AlcoholShellEx"
\InProcServer32\(Default) = "D:\ALCOHO~2\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Folder przesyłania Share-to-Web"
-> {HKLM...CLSID} = "Folder przesyłania Share-to-Web"
\InProcServer32\(Default) = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"]
"{0A082D00-EC93-11D0-B1E6-80580BC10627}" = "Corel Media Folder Root Menu Handler"
-> {HKLM...CLSID} = "Corel Media Folder Root Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}" = "Folder To Corel Media Folder Menu Handler"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{854AF161-1AE1-11D1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{E856F161-1AE5-11d1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{CDB89701-262F-11D1-AB9C-00C0F00683EB}" = "Corel Media Find Folder"
-> {HKLM...CLSID} = "Corel Media Find Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{F8152501-455F-11D1-B1E6-444553540000}" = "Corel Media Folder Copy Hook Handler"
-> {HKLM...CLSID} = "Corel Media Folder Copy Hook Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{8E524B0D-04F0-11D1-B74A-00A0C90646A4}" = "IconFactTemp.NSIconHandlerFactory"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{A2AC368A-F883-11D0-B745-00A0C90646A4}" = "NSFiltManDll.FiltManCom"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser"
-> {HKLM...CLSID} = "Nokia Phone Browser"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"]
"{FBFE7864-D495-41f0-B7DC-4BB601CC295E}" = "Contact View"
-> {HKLM...CLSID} = "Contact View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\ContactView.dll" ["Nokia"]
"{C0C4375A-5B72-4efe-929D-3B848C3A1E91}" = "Message View"
-> {HKLM...CLSID} = "Message View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll" ["Nokia"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
-> {HKLM...CLSID} = "Moje foldery udostępniania"
\InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.0.0792.00.dll" [MS]
"{229C848C-2C03-4079-BE63-F13477456B27}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\oobccp32.dll" [file not found]
"{CF85F7EA-0029-4D91-A63C-FB9A4463FC5E}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nitui1.dll" [file not found]
"{49E73640-405D-4019-90F3-6FB09394F223}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\izaksie.dll" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e" [file not found], [MS], [file not found], [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
FolderToCorelMediaFolder\(Default) = "{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]

Startup items in "Administrator" & "All Users" startup folders:
---------------------------------------------------------------

C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart
"SpeedFan" -> shortcut to: "C:\Program Files\SpeedFan\speedfan.exe" ["Almico Software (www.almico.com)"]

Enabled Scheduled Tasks:
------------------------

"At1" -> launches: "C:\DOCUME~1\ADMINI~1\Pulpit\Look2Me-Destroyer.exe /task" [file not found]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 18
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}"
-> {HKLM...CLSID} = "My &Web Search"
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL" [file not found]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{86227D9C-0EFE-4F8A-AA55-30386A3F5686}"
-> {HKLM...CLSID} = "YourSiteBar"
\InProcServer32\(Default) = "C:\Program Files\YourSiteBar\ysb.dll" [file not found]
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}"
-> {HKLM...CLSID} = "My &Web Search"
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL" [file not found]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar"
-> {HKLM...CLSID} = "FlashGet Bar"
\InProcServer32\(Default) = "C:\PROGRA~1\FLASHGET\fgiebar.dll" ["Amaze Soft"]

Explorer Bars

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLM\Software\Classes\CLSID\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}\(Default) = "My Web Search Quick View"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "&FlashGet"
"Exec" = "C:\PROGRA~1\FLASHGET\flashget.exe" ["Amaze Soft"]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Diskeeper, Diskeeper, ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe"" ["Diskeeper Corporation"]
ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]
LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
NVIDIA Display Driver Service (Omega 1.6177) (Q), NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
StarWind iSCSI Service, StarWindService, "D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
hpzsnt08\Driver = "hpzsnt08.dll" ["HP"]

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 49 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 25 seconds.
---------- (total run time: 107 seconds)

**Posty:** 8694 · przez **Red** 28 Lip 2006, 21:44

otwierasz notatnik windowsa i wklejasz w nim to co ponizej:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"{20B68834-07CF-1045-1020-041021020030}"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000
"**del.DisableTaskMgr"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableTaskMgr"=dword:00000000

w notatniku u góry>>>plik zapisz jako>>>Zmienić rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisać pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

Restar kompa ....a po restarcie prosze sciagnac:
http://www.kaspersky.pl/virusscanner.html
odpal go z IE przeskanuj sysytem i wklej wynik na forum.....
dodaj do tego oczywiscie dwa logi powyzej nam znane

**Posty:** 8079 · przez **kajtekjr** 28 Lip 2006, 23:29

Log z HJ:

Logfile of HijackThis v1.99.1
Scan saved at 23:19:20, on 2006-07-28
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\htpatch.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\outlook\outlook.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Internet Explorer\iexplore.exe
E:\BitSpirit\BitSpirit.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\WINDOWS\System32\WScript.exe
C:\Documents and Settings\Administrator\Pulpit\Narzedzia antywirusowe!\hijackthis_199\HijackThis.exe

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm
O8 - Extra context menu item: RapidShare-Download - res://C:\Documents and Settings\Administrator\Pulpit\Nowy folder (2)\More RapidShare\more-rapid.exe/RsMenExt.html
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F861EC59-9164-4468-8FA6-FC61736E8094}: NameServer = 194.204.152.34 217.98.63.164
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

==============================
:arrow:

Log z Silent Runners:

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"(Default)" = (empty string)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]
"SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"HP Software Update" = "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [null data]
"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" ["HP"]
"DeviceDiscovery" = "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]
"DiskeeperSystray" = ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"" ["Diskeeper Corporation"]
"Logitech Utility" = "LOGI_MWX.EXE" ["Logitech Inc."]
"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]
"DataLayer" = "C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" ["Nokia Mobile Phones Ltd."]
"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [file not found]
"outlook" = "C:\Program Files\outlook\outlook.exe /auto" ["InstallShield Software Corporation"]
"MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
-> {HKLM...CLSID} = "AlcoholShellEx"
\InProcServer32\(Default) = "D:\ALCOHO~2\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Folder przesyłania Share-to-Web"
-> {HKLM...CLSID} = "Folder przesyłania Share-to-Web"
\InProcServer32\(Default) = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"]
"{0A082D00-EC93-11D0-B1E6-80580BC10627}" = "Corel Media Folder Root Menu Handler"
-> {HKLM...CLSID} = "Corel Media Folder Root Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}" = "Folder To Corel Media Folder Menu Handler"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{854AF161-1AE1-11D1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{E856F161-1AE5-11d1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{CDB89701-262F-11D1-AB9C-00C0F00683EB}" = "Corel Media Find Folder"
-> {HKLM...CLSID} = "Corel Media Find Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{F8152501-455F-11D1-B1E6-444553540000}" = "Corel Media Folder Copy Hook Handler"
-> {HKLM...CLSID} = "Corel Media Folder Copy Hook Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{8E524B0D-04F0-11D1-B74A-00A0C90646A4}" = "IconFactTemp.NSIconHandlerFactory"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{A2AC368A-F883-11D0-B745-00A0C90646A4}" = "NSFiltManDll.FiltManCom"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser"
-> {HKLM...CLSID} = "Nokia Phone Browser"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"]
"{FBFE7864-D495-41f0-B7DC-4BB601CC295E}" = "Contact View"
-> {HKLM...CLSID} = "Contact View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\ContactView.dll" ["Nokia"]
"{C0C4375A-5B72-4efe-929D-3B848C3A1E91}" = "Message View"
-> {HKLM...CLSID} = "Message View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll" ["Nokia"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
-> {HKLM...CLSID} = "Moje foldery udostępniania"
\InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.0.0792.00.dll" [MS]
"{229C848C-2C03-4079-BE63-F13477456B27}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\oobccp32.dll" [file not found]
"{CF85F7EA-0029-4D91-A63C-FB9A4463FC5E}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nitui1.dll" [file not found]
"{49E73640-405D-4019-90F3-6FB09394F223}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\izaksie.dll" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e" [file not found], [MS], [file not found], [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
FolderToCorelMediaFolder\(Default) = "{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]

Startup items in "Administrator" & "All Users" startup folders:
---------------------------------------------------------------

C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart
"SpeedFan" -> shortcut to: "C:\Program Files\SpeedFan\speedfan.exe" ["Almico Software (www.almico.com)"]

Enabled Scheduled Tasks:
------------------------

"At1" -> launches: "C:\DOCUME~1\ADMINI~1\Pulpit\Look2Me-Destroyer.exe /task" [file not found]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 18
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}"
-> {HKLM...CLSID} = "My &Web Search"
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL" [file not found]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{86227D9C-0EFE-4F8A-AA55-30386A3F5686}"
-> {HKLM...CLSID} = "YourSiteBar"
\InProcServer32\(Default) = "C:\Program Files\YourSiteBar\ysb.dll" [file not found]
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}"
-> {HKLM...CLSID} = "My &Web Search"
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL" [file not found]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar"
-> {HKLM...CLSID} = "FlashGet Bar"
\InProcServer32\(Default) = "C:\PROGRA~1\FLASHGET\fgiebar.dll" ["Amaze Soft"]

Explorer Bars

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLM\Software\Classes\CLSID\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}\(Default) = "My Web Search Quick View"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "&FlashGet"
"Exec" = "C:\PROGRA~1\FLASHGET\flashget.exe" ["Amaze Soft"]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Diskeeper, Diskeeper, ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe"" ["Diskeeper Corporation"]
ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]
LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
NVIDIA Display Driver Service (Omega 1.6177) (Q), NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
StarWind iSCSI Service, StarWindService, "D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
hpzsnt08\Driver = "hpzsnt08.dll" ["HP"]

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 70 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 36 seconds.
---------- (total run time: 150 seconds)

==============================
:arrow:

Raport z Kaspersky:

-------------------------------------------------------------------------------
RAPORT KASPERSKY ON-LINE SCANNER
Friday, July 28, 2006 23:18:20
System operacyjny: Microsoft Windows XP Professional, Dodatek Service Pack 2 (Build 2600)
Kaspersky On-line Scanner wersja: 5.0.68.0
Ostatnia aktualizacja Kaspersky Anti-Virus: 28/07/2006
Liczba wpisów w bazie danych Kaspersky Anti-Virus: 197171
-------------------------------------------------------------------------------

Ustawienia skanowania:
Skanowanie przy użyciu następujących baz danych: standardowe
Skanuj archiwa: tak
Skanuj pocztowe bazy danych: tak

Obszar skanowania - Mój komputer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\

Statystyki skanowania:
Liczba skanowanych obiektów: 77490
Liczba wykrytych wirusów: 23
Liczba zainfekowanych obiektów: 88
Liczba podejrzanych obiektów: 0
Czas trwania skanowania: 01:08:38

Nazwa zainfekowanego obiektu / Nazwa wirusa / Ostatnie działanie
C:\WINDOWS\system32\winlog.exe Zainfekowany: Backdoor.Win32.EggDrop.v pominięty
C:\WINDOWS\MTE3NDI6ODoxNg.exe Zainfekowany: Trojan-Downloader.Win32.Small.buy pominięty
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temporary Internet Files\Content.IE5\SBH7YER9\i[1].exe Zainfekowany: Trojan-Downloader.Win32.VB.aik pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-cb66fa7-78ff0bda.zip/GetAccess.class Zainfekowany: Trojan-Downloader.Java.OpenConnection.aj pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-cb66fa7-78ff0bda.zip/Installer.class Zainfekowany: Trojan-Downloader.Java.OpenConnection.aj pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-cb66fa7-78ff0bda.zip ZIP: 2 zainfekowanych pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv470.jar-217a6652-43a00582.zip/Matrix.class Zainfekowany: Trojan-Downloader.Java.OpenStream.c pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv470.jar-217a6652-43a00582.zip/Counter.class Zainfekowany: Trojan.Java.ClassLoader.h pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv470.jar-217a6652-43a00582.zip/Parser.class Zainfekowany: Trojan.Java.ClassLoader.d pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv470.jar-217a6652-43a00582.zip ZIP: 3 zainfekowanych pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-10015c94-72fdbf50.zip/GetAccess.class Zainfekowany: Trojan-Downloader.Java.OpenConnection.aj pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-10015c94-72fdbf50.zip/Installer.class Zainfekowany: Trojan-Downloader.Java.OpenConnection.aj pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-10015c94-72fdbf50.zip ZIP: 2 zainfekowanych pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-bb2613b-65db8709.zip/GetAccess.class Zainfekowany: Trojan-Downloader.Java.OpenConnection.aj pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-bb2613b-65db8709.zip/Installer.class Zainfekowany: Trojan-Downloader.Java.OpenConnection.aj pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-bb2613b-65db8709.zip ZIP: 2 zainfekowanych pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv435.jar-19e96aef-50904d0c.zip/Matrix.class Zainfekowany: Trojan-Downloader.Java.OpenStream.c pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv435.jar-19e96aef-50904d0c.zip/Counter.class Zainfekowany: Trojan.Java.ClassLoader.h pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv435.jar-19e96aef-50904d0c.zip/Parser.class Zainfekowany: Trojan.Java.ClassLoader.d pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv435.jar-19e96aef-50904d0c.zip ZIP: 3 zainfekowanych pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-4dafb790-69639c18.zip/GetAccess.class Zainfekowany: Trojan.Java.ClassLoader.c pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-4dafb790-69639c18.zip/InsecureClassLoader.class Zainfekowany: Exploit.Java.ByteVerify pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-4dafb790-69639c18.zip/Dummy.class Zainfekowany: Trojan.Java.ClassLoader.Dummy.a pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-4dafb790-69639c18.zip/Installer.class Zainfekowany: Trojan-Downloader.Java.OpenConnection.v pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-4dafb790-69639c18.zip ZIP: 4 zainfekowanych pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-5f22f99-11485abf.zip/GetAccess.class Zainfekowany: Trojan-Downloader.Java.OpenConnection.aj pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-5f22f99-11485abf.zip/Installer.class Zainfekowany: Trojan-Downloader.Java.OpenConnection.aj pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-5f22f99-11485abf.zip ZIP: 2 zainfekowanych pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv470.jar-1ab62644-4dcbbc26.zip/Matrix.class Zainfekowany: Trojan-Downloader.Java.OpenStream.c pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv470.jar-1ab62644-4dcbbc26.zip/Counter.class Zainfekowany: Trojan.Java.ClassLoader.h pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv470.jar-1ab62644-4dcbbc26.zip/Parser.class Zainfekowany: Trojan.Java.ClassLoader.d pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv470.jar-1ab62644-4dcbbc26.zip ZIP: 3 zainfekowanych pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-7e95719a-3f6395bb.zip/BlackBox.class Zainfekowany: Exploit.Java.ByteVerify pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-7e95719a-3f6395bb.zip/VerifierBug.class Zainfekowany: Exploit.Java.ByteVerify pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-7e95719a-3f6395bb.zip/Beyond.class Zainfekowany: Trojan-Downloader.Java.OpenConnection.aa pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-7e95719a-3f6395bb.zip ZIP: 3 zainfekowanych pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-524dd1c-272adb5d.zip/BlackBox.class Zainfekowany: Exploit.Java.ByteVerify pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-524dd1c-272adb5d.zip/VerifierBug.class Zainfekowany: Exploit.Java.ByteVerify pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-524dd1c-272adb5d.zip/Beyond.class Zainfekowany: Trojan-Downloader.Java.OpenConnection.aa pominięty
C:\Documents and Settings\Administrator\Dane aplikacji\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-524dd1c-272adb5d.zip ZIP: 3 zainfekowanych pominięty
C:\Documents and Settings\Administrator\setup.exe Zainfekowany: Trojan-Downloader.Win32.VB.aik pominięty
C:\Documents and Settings\Administrator\dr.exe Zainfekowany: Trojan-Downloader.Win32.Adload.cw pominięty
C:\Program Files\Common Files\simtest\sysstall.exe Zainfekowany: Trojan.Win32.Zapchast.bl pominięty
C:\Program Files\Common Files\misc001\Mendoza.exe/data0006 Zainfekowany: Trojan-Dropper.Win32.VB.mz pominięty
C:\Program Files\Common Files\misc001\Mendoza.exe NSIS: 1 zainfekowanych pominięty
C:\Program Files\outlook\outlook.exe Zainfekowany: P2P-Worm.Win32.VB.dw pominięty
C:\Program Files\outlook\v.tmp Zainfekowany: P2P-Worm.Win32.VB.dw pominięty
C:\Program Files\outlook\p.zip/Setup.exe Zainfekowany: P2P-Worm.Win32.VB.dw pominięty
C:\Program Files\outlook\p.zip ZIP: 1 zainfekowanych pominięty
C:\Program Files\shell32.exe Zainfekowany: Trojan-Downloader.Win32.IstBar.gen pominięty
C:\Program Files\winupdates\winupdates.exe Zainfekowany: Worm.Win32.VB.an pominięty
C:\Program Files\winupdates\a.tmp Zainfekowany: Worm.Win32.VB.an pominięty
C:\Program Files\winupdates\a.zip/Setup.exe Zainfekowany: Worm.Win32.VB.an pominięty
C:\Program Files\winupdates\a.zip ZIP: 1 zainfekowanych pominięty
C:\Downloads\USA crack.exe/user32.exe Zainfekowany: Trojan-Downloader.Win32.Harnig.bh pominięty
C:\Downloads\USA crack.exe/dr.exe Zainfekowany: Trojan-Downloader.Win32.Adload.ap pominięty
C:\Downloads\USA crack.exe/shell32.exe Zainfekowany: Trojan-Downloader.Win32.IstBar.gen pominięty
C:\Downloads\USA crack.exe SetupFactory: 3 zainfekowanych pominięty
C:\Downloads\Deutsch crack.exe/user32.exe Zainfekowany: Trojan-Downloader.Win32.Harnig.bh pominięty
C:\Downloads\Deutsch crack.exe/dr.exe Zainfekowany: Trojan-Downloader.Win32.Adload.ap pominięty
C:\Downloads\Deutsch crack.exe/shell32.exe Zainfekowany: Trojan-Downloader.Win32.IstBar.gen pominięty
C:\Downloads\Deutsch crack.exe SetupFactory: 3 zainfekowanych pominięty
C:\Downloads\cracked.exe/user32.exe Zainfekowany: Trojan-Downloader.Win32.Harnig.bh pominięty
C:\Downloads\cracked.exe/dr.exe Zainfekowany: Trojan-Downloader.Win32.Adload.ap pominięty
C:\Downloads\cracked.exe/shell32.exe Zainfekowany: Trojan-Downloader.Win32.IstBar.gen pominięty
C:\Downloads\cracked.exe SetupFactory: 3 zainfekowanych pominięty
E:\My Downloads\dobre chuzzes\Setup.exe Zainfekowany: Worm.Win32.VB.an pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0007/data0007 Zainfekowany: Trojan-Downloader.Win32.Keenval.n pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0007 Zainfekowany: Trojan-Downloader.Win32.Keenval.n pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0011/data0002/data0006 Zainfekowany: Trojan-Downloader.Win32.Keenval.h pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0011/data0002 Zainfekowany: Trojan-Downloader.Win32.Keenval.h pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0011/data0005 Zainfekowany: Trojan.Win32.Keenval.a pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0011 Zainfekowany: Trojan.Win32.Keenval.a pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe Zainfekowany: Trojan.Win32.Keenval.a pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe Zainfekowany: Trojan.Win32.Keenval.a pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe Zainfekowany: Trojan.Win32.Keenval.a pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar Zainfekowany: Trojan.Win32.Keenval.a pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar RAR: 10 zainfekowanych pominięty
E:\My Downloads\more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)\Magic Ball\Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0007/data0007 Zainfekowany: Trojan-Downloader.Win32.Keenval.n pominięty
E:\My Downloads\more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)\Magic Ball\Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0007 Zainfekowany: Trojan-Downloader.Win32.Keenval.n pominięty
E:\My Downloads\more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)\Magic Ball\Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0011/data0002/data0006 Zainfekowany: Trojan-Downloader.Win32.Keenval.h pominięty
E:\My Downloads\more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)\Magic Ball\Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0011/data0002 Zainfekowany: Trojan-Downloader.Win32.Keenval.h pominięty
E:\My Downloads\more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)\Magic Ball\Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0011/data0005 Zainfekowany: Trojan.Win32.Keenval.a pominięty
E:\My Downloads\more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)\Magic Ball\Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0011 Zainfekowany: Trojan.Win32.Keenval.a pominięty
E:\My Downloads\more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)\Magic Ball\Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe Zainfekowany: Trojan.Win32.Keenval.a pominięty
E:\My Downloads\more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)\Magic Ball\Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe Zainfekowany: Trojan.Win32.Keenval.a pominięty
E:\My Downloads\more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)\Magic Ball\Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe Zainfekowany: Trojan.Win32.Keenval.a pominięty
E:\My Downloads\more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)\Magic Ball\Breakout Magic Ball-2 V2.1 + Serial.rar RAR: 9 zainfekowanych pominięty

Proces skanowania został zakończony.

[ Dodano: Dzisiaj o 11:39 ]
Jeszcze teraz rano właczyłem ewido anti-spyware, usunąłem wszystko co znalazł i daje raport:

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 11:29:23 2006-07-29

+ Scan result:

C:\WINDOWS\RmlsaXBpYWs\asappsrv.dll -> Adware.CommAd : Cleaned.
C:\WINDOWS\RmlsaXBpYWs\command.exe -> Adware.CommAd : Cleaned.
E:\RECYCLER\S-1-5-21-1960408961-448539723-725345543-500\De1\Match Blox\MatchBlox v.1.06.exe/cd_clint.dll -> Adware.Cydoor : Cleaned.
E:\RECYCLER\S-1-5-21-1960408961-448539723-725345543-500\De1\Match Blox\MatchBlox v.1.06.exe/cd_load.exe -> Adware.Cydoor : Cleaned.
E:\RECYCLER\S-1-5-21-1960408961-448539723-725345543-500\De1\Match Blox\MatchBlox v.1.06.exe/cd_swf.dll -> Adware.Cydoor : Cleaned.
C:\Program Files\ToolBar888\MyToolBar.dll -> Adware.Softomate : Cleaned.
C:\WINDOWS\system32\winlog.exe -> Backdoor.Rbot : Cleaned.
C:\WINDOWS\MTE3NDI6ODoxNg.exe -> Downloader.Small.buy : Cleaned.
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temporary Internet Files\Content.IE5\SBH7YER9\i[1].exe -> Downloader.VB.aik : Cleaned.
C:\Documents and Settings\Administrator\setup.exe -> Downloader.VB.aik : Cleaned.
C:\Program Files\Network Monitor\netmon.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned.
:mozilla.225:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.226:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\Cookies\administrator@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.181:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.187:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.166:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Addynamix : Cleaned.
:mozilla.167:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Addynamix : Cleaned.
:mozilla.433:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adition : Cleaned.
:mozilla.434:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adition : Cleaned.
:mozilla.69:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.70:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.85:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.86:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Adocean : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@ad.adocean[1].txt -> TrackingCookie.Adocean : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@gde.adocean[2].txt -> TrackingCookie.Adocean : Cleaned.
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\Cookies\administrator@ad.adocean[1].txt -> TrackingCookie.Adocean : Cleaned.
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\Cookies\administrator@gde.adocean[2].txt -> TrackingCookie.Adocean : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.168:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\Cookies\administrator@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.352:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.353:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@www.burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\Cookies\administrator@www.burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.267:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.268:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.270:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.271:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.238:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Clickbank : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@com[1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\Cookies\administrator@com[1].txt -> TrackingCookie.Com : Cleaned.
:mozilla.274:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.357:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Epilot : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@as-eu.falkag[1].txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.350:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.354:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@media.fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\Cookies\administrator@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\Cookies\administrator@media.fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.194:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Findwhat : Cleaned.
:mozilla.298:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.432:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@ehg-bskyb.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.177:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Hotlog : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@hotlog[2].txt -> TrackingCookie.Hotlog : Cleaned.
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\Cookies\administrator@ilead.itrack[1].txt -> TrackingCookie.Itrack : Cleaned.
:mozilla.368:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Ivwbox : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@ivwbox[1].txt -> TrackingCookie.Ivwbox : Cleaned.
:mozilla.293:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Komtrack : Cleaned.
:mozilla.294:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Komtrack : Cleaned.
:mozilla.344:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.345:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@mediaplex[2].txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.392:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.393:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.394:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.399:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.400:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@data2.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
:mozilla.369:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.178:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Spylog : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@spylog[1].txt -> TrackingCookie.Spylog : Cleaned.
:mozilla.180:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.184:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.185:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.186:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.349:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.351:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.58:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.59:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.60:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.61:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.62:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.63:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.64:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.65:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.66:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\Cookies\administrator@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.269:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.355:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Valueclick : Cleaned.
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\Cookies\administrator@vegasred[2].txt -> TrackingCookie.Vegasred : Cleaned.
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\Cookies\administrator@www.vegasred[1].txt -> TrackingCookie.Vegasred : Cleaned.
:mozilla.231:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.192:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Wegcash : Cleaned.
:mozilla.193:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Wegcash : Cleaned.
:mozilla.179:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yadro : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@yadro[2].txt -> TrackingCookie.Yadro : Cleaned.
:mozilla.130:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.131:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.132:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.133:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.134:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Profiles\default\rjojarb9.slt\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\Cookies\administrator@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@c5.zedo[2].txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@zedo[1].txt -> TrackingCookie.Zedo : Cleaned.
C:\Program Files\Common Files\{20B68834-07CF-1045-1020-041021020030}\Update.exe -> Trojan.Starter.65 : Cleaned.
C:\Program Files\Common Files\simtest\sysstall.exe -> Trojan.Zapchast.bl : Cleaned.
C:\Program Files\winupdates\a.tmp -> Worm.VB.an : Cleaned.
C:\Program Files\winupdates\a.zip/Setup.exe -> Worm.VB.an : Cleaned.
C:\Program Files\winupdates\winupdates.exe -> Worm.VB.an : Cleaned.
E:\My Downloads\dobre chuzzes\Setup.exe -> Worm.VB.an : Cleaned.
C:\Program Files\outlook\outlook.exe -> Worm.VB.dw : Cleaned.
C:\Program Files\outlook\p.zip/Setup.exe -> Worm.VB.dw : Cleaned.
C:\Program Files\outlook\v.tmp -> Worm.VB.dw : Cleaned.
[256] C:\Program Files\outlook\outlook.exe -> Worm.VB.dw : Error during cleaning.

::Report end

**Posty:** 8694 · przez **Red** 29 Lip 2006, 21:54

mocno cra kujesz ,bardzo mocno......

wykonaj:
Panel sterowania>> Java Plug-in>>> Cache >> klikasz>>> Clear>>ok

zrestartuj kompa i podeslij jeszcze raz nowy log z kaspersky online ,bo widze ze ewido troche smieci skosił i wynik moze byc ciekawy.

**Posty:** 8079 · przez **kajtekjr** 30 Lip 2006, 10:31

Red napisał(a):wykonaj:
Panel sterowania>> Java Plug-in>>> Cache >> klikasz>>> Clear>>ok

w Panelu sterowania jest tylko Java, po klikniecu 2x na ikonke pokazuje sie okno podpisane Java Control Panel i nie ma tam zakładki Cache

U mnie wyglada to tak:

**Posty:** 1665 · przez **SER** 30 Lip 2006, 12:29

Kliknij Delete Files

Red napisał(a):zrestartuj kompa i podeslij jeszcze raz nowy log z kaspersky online

**Posty:** 8079 · przez **kajtekjr** 30 Lip 2006, 19:59

Log z HJ:

Logfile of HijackThis v1.99.1
Scan saved at 19:47:13, on 2006-07-30
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\htpatch.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\Program Files\Tlen.pl\tlen.exe
C:\Documents and Settings\Administrator\Pulpit\Narzedzia antywirusowe!\hijackthis_199\HijackThis.exe

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm
O8 - Extra context menu item: RapidShare-Download - res://C:\Documents and Settings\Administrator\Pulpit\Nowy folder (2)\More RapidShare\more-rapid.exe/RsMenExt.html
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F861EC59-9164-4468-8FA6-FC61736E8094}: NameServer = 194.204.152.34 217.98.63.164
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

=====================================
:arrow:

Log z Silent Runners:

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"(Default)" = (empty string)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]
"SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"HP Software Update" = "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [null data]
"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" ["HP"]
"DeviceDiscovery" = "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]
"DiskeeperSystray" = ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"" ["Diskeeper Corporation"]
"Logitech Utility" = "LOGI_MWX.EXE" ["Logitech Inc."]
"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]
"DataLayer" = "C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" ["Nokia Mobile Phones Ltd."]
"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [file not found]
"outlook" = "C:\Program Files\outlook\outlook.exe /auto" [file not found]
"MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
-> {HKLM...CLSID} = "AlcoholShellEx"
\InProcServer32\(Default) = "D:\ALCOHO~2\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Folder przesyłania Share-to-Web"
-> {HKLM...CLSID} = "Folder przesyłania Share-to-Web"
\InProcServer32\(Default) = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"]
"{0A082D00-EC93-11D0-B1E6-80580BC10627}" = "Corel Media Folder Root Menu Handler"
-> {HKLM...CLSID} = "Corel Media Folder Root Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}" = "Folder To Corel Media Folder Menu Handler"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{854AF161-1AE1-11D1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{E856F161-1AE5-11d1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{CDB89701-262F-11D1-AB9C-00C0F00683EB}" = "Corel Media Find Folder"
-> {HKLM...CLSID} = "Corel Media Find Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{F8152501-455F-11D1-B1E6-444553540000}" = "Corel Media Folder Copy Hook Handler"
-> {HKLM...CLSID} = "Corel Media Folder Copy Hook Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{8E524B0D-04F0-11D1-B74A-00A0C90646A4}" = "IconFactTemp.NSIconHandlerFactory"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{A2AC368A-F883-11D0-B745-00A0C90646A4}" = "NSFiltManDll.FiltManCom"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser"
-> {HKLM...CLSID} = "Nokia Phone Browser"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"]
"{FBFE7864-D495-41f0-B7DC-4BB601CC295E}" = "Contact View"
-> {HKLM...CLSID} = "Contact View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\ContactView.dll" ["Nokia"]
"{C0C4375A-5B72-4efe-929D-3B848C3A1E91}" = "Message View"
-> {HKLM...CLSID} = "Message View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll" ["Nokia"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
-> {HKLM...CLSID} = "Moje foldery udostępniania"
\InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.0.0792.00.dll" [MS]
"{229C848C-2C03-4079-BE63-F13477456B27}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\oobccp32.dll" [file not found]
"{CF85F7EA-0029-4D91-A63C-FB9A4463FC5E}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nitui1.dll" [file not found]
"{49E73640-405D-4019-90F3-6FB09394F223}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\izaksie.dll" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e" [file not found], [MS], [file not found], [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
FolderToCorelMediaFolder\(Default) = "{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]

Startup items in "Administrator" & "All Users" startup folders:
---------------------------------------------------------------

C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart
"SpeedFan" -> shortcut to: "C:\Program Files\SpeedFan\speedfan.exe" ["Almico Software (www.almico.com)"]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 18
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}"
-> {HKLM...CLSID} = "My &Web Search"
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL" [file not found]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{86227D9C-0EFE-4F8A-AA55-30386A3F5686}"
-> {HKLM...CLSID} = "YourSiteBar"
\InProcServer32\(Default) = "C:\Program Files\YourSiteBar\ysb.dll" [file not found]
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}"
-> {HKLM...CLSID} = "My &Web Search"
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL" [file not found]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar"
-> {HKLM...CLSID} = "FlashGet Bar"
\InProcServer32\(Default) = "C:\PROGRA~1\FLASHGET\fgiebar.dll" ["Amaze Soft"]

Explorer Bars

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLM\Software\Classes\CLSID\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}\(Default) = "My Web Search Quick View"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "&FlashGet"
"Exec" = "C:\PROGRA~1\FLASHGET\flashget.exe" ["Amaze Soft"]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Diskeeper, Diskeeper, ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe"" ["Diskeeper Corporation"]
ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]
LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
NVIDIA Display Driver Service (Omega 1.6177) (Q), NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
StarWind iSCSI Service, StarWindService, "D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
hpzsnt08\Driver = "hpzsnt08.dll" ["HP"]

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 47 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 24 seconds.
---------- (total run time: 107 seconds)

=====================================
:arrow:

Raport z Kaspersky:

-------------------------------------------------------------------------------
RAPORT KASPERSKY ON-LINE SCANNER
Sunday, July 30, 2006 19:46:17
System operacyjny: Microsoft Windows XP Professional, Dodatek Service Pack 2 (Build 2600)
Kaspersky On-line Scanner wersja: 5.0.68.0
Ostatnia aktualizacja Kaspersky Anti-Virus: 30/07/2006
Liczba wpisów w bazie danych Kaspersky Anti-Virus: 198299
-------------------------------------------------------------------------------

Ustawienia skanowania:
Skanowanie przy użyciu następujących baz danych: standardowe
Skanuj archiwa: tak
Skanuj pocztowe bazy danych: tak

Obszar skanowania - Mój komputer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
J:\

Statystyki skanowania:
Liczba skanowanych obiektów: 69547
Liczba wykrytych wirusów: 5
Liczba zainfekowanych obiektów: 14
Liczba podejrzanych obiektów: 0
Czas trwania skanowania: 00:51:05

Nazwa zainfekowanego obiektu / Nazwa wirusa / Ostatnie działanie
C:\Documents and Settings\Administrator\dr.exe Zainfekowany: Trojan-Downloader.Win32.Adload.cw pominięty
C:\Program Files\Common Files\misc001\Mendoza.exe/data0006 Zainfekowany: Trojan-Dropper.Win32.VB.mz pominięty
C:\Program Files\Common Files\misc001\Mendoza.exe NSIS: 1 zainfekowanych pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0007/data0007 Zainfekowany: Trojan-Downloader.Win32.Keenval.n pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0007 Zainfekowany: Trojan-Downloader.Win32.Keenval.n pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0011/data0002/data0006 Zainfekowany: Trojan-Downloader.Win32.Keenval.h pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0011/data0002 Zainfekowany: Trojan-Downloader.Win32.Keenval.h pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0011/data0005 Zainfekowany: Trojan.Win32.Keenval.a pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe/data0011 Zainfekowany: Trojan.Win32.Keenval.a pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe/Alawar_bundle.exe Zainfekowany: Trojan.Win32.Keenval.a pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe/Alawar_gamebar.exe Zainfekowany: Trojan.Win32.Keenval.a pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar/MagicBall2.exe Zainfekowany: Trojan.Win32.Keenval.a pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar/more than 120 games cracked(popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc)/Magic Ball/Breakout Magic Ball-2 V2.1 + Serial.rar Zainfekowany: Trojan.Win32.Keenval.a pominięty
E:\My Downloads\more than 120 games cracked (popcap,alaware,GameHouse,luxor,Zuma,Chainz,Tetris,Ricochet,Equilibria,Kahuna Reef,Rocket Mania,Brick,Shooter,zib, Etc).rar RAR: 10 zainfekowanych pominięty

Proces skanowania został zakończony.

PS. Sorrki ze dopiero teraz ale wczesniej nie mogłem ;(

**Posty:** 8694 · przez **Red** 31 Lip 2006, 10:18

pozbadz sie:

C:\Documents and Settings\Administrator\dr.exe
C:\Program Files\Common Files\misc001\Mendoza.exe/data0006
C:\Program Files\Common Files\misc001\Mendoza.exe

**Posty:** 8079 · przez **kajtekjr** 31 Lip 2006, 12:13

Red napisał(a):pozbadz sie:

C:\Documents and Settings\Administrator\dr.exe
C:\Program Files\Common Files\misc001\Mendoza.exe/data0006
C:\Program Files\Common Files\misc001\Mendoza.exe

Poszło

Wrzucam jeszcze kontrolne logi:
:arrow:

Log z HJ:

Logfile of HijackThis v1.99.1
Scan saved at 12:04:34, on 2006-07-31
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
E:\BitSpirit\BitSpirit.exe
C:\Program Files\Tlen.pl\tlen.exe
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\Documents and Settings\Administrator\Pulpit\Narzedzia antywirusowe!\hijackthis_199\HijackThis.exe

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm
O8 - Extra context menu item: RapidShare-Download - res://C:\Documents and Settings\Administrator\Pulpit\Nowy folder (2)\More RapidShare\more-rapid.exe/RsMenExt.html
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F861EC59-9164-4468-8FA6-FC61736E8094}: NameServer = 194.204.152.34 217.98.63.164
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

=====================================
:arrow:

Log z Silent Runners:

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"(Default)" = (empty string)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]
"SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"HP Software Update" = "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [null data]
"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" ["HP"]
"DeviceDiscovery" = "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]
"DiskeeperSystray" = ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"" ["Diskeeper Corporation"]
"Logitech Utility" = "LOGI_MWX.EXE" ["Logitech Inc."]
"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]
"DataLayer" = "C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe" ["Nokia Mobile Phones Ltd."]
"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [file not found]
"outlook" = "C:\Program Files\outlook\outlook.exe /auto" [file not found]
"MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
-> {HKLM...CLSID} = "AlcoholShellEx"
\InProcServer32\(Default) = "D:\ALCOHO~2\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Folder przesyłania Share-to-Web"
-> {HKLM...CLSID} = "Folder przesyłania Share-to-Web"
\InProcServer32\(Default) = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"]
"{0A082D00-EC93-11D0-B1E6-80580BC10627}" = "Corel Media Folder Root Menu Handler"
-> {HKLM...CLSID} = "Corel Media Folder Root Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}" = "Folder To Corel Media Folder Menu Handler"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{854AF161-1AE1-11D1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{E856F161-1AE5-11d1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{CDB89701-262F-11D1-AB9C-00C0F00683EB}" = "Corel Media Find Folder"
-> {HKLM...CLSID} = "Corel Media Find Folder"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{F8152501-455F-11D1-B1E6-444553540000}" = "Corel Media Folder Copy Hook Handler"
-> {HKLM...CLSID} = "Corel Media Folder Copy Hook Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
"{8E524B0D-04F0-11D1-B74A-00A0C90646A4}" = "IconFactTemp.NSIconHandlerFactory"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{A2AC368A-F883-11D0-B745-00A0C90646A4}" = "NSFiltManDll.FiltManCom"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CNSFlt80.dll" ["Corel Corporation"]
"{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser"
-> {HKLM...CLSID} = "Nokia Phone Browser"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"]
"{FBFE7864-D495-41f0-B7DC-4BB601CC295E}" = "Contact View"
-> {HKLM...CLSID} = "Contact View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\ContactView.dll" ["Nokia"]
"{C0C4375A-5B72-4efe-929D-3B848C3A1E91}" = "Message View"
-> {HKLM...CLSID} = "Message View"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll" ["Nokia"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
-> {HKLM...CLSID} = "Moje foldery udostępniania"
\InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.0.0792.00.dll" [MS]
"{229C848C-2C03-4079-BE63-F13477456B27}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\oobccp32.dll" [file not found]
"{CF85F7EA-0029-4D91-A63C-FB9A4463FC5E}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nitui1.dll" [file not found]
"{49E73640-405D-4019-90F3-6FB09394F223}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\izaksie.dll" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e" [file not found], [MS], [file not found], [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
FolderToCorelMediaFolder\(Default) = "{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\Corel\Graphics8\programs\CMFFld80.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]

Startup items in "Administrator" & "All Users" startup folders:
---------------------------------------------------------------

C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart
"SpeedFan" -> shortcut to: "C:\Program Files\SpeedFan\speedfan.exe" ["Almico Software (www.almico.com)"]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 18
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}"
-> {HKLM...CLSID} = "My &Web Search"
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL" [file not found]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{86227D9C-0EFE-4F8A-AA55-30386A3F5686}"
-> {HKLM...CLSID} = "YourSiteBar"
\InProcServer32\(Default) = "C:\Program Files\YourSiteBar\ysb.dll" [file not found]
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}"
-> {HKLM...CLSID} = "My &Web Search"
\InProcServer32\(Default) = "C:\Program Files\MyWebSearch\bar\8.bin\MWSBAR.DLL" [file not found]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar"
-> {HKLM...CLSID} = "FlashGet Bar"
\InProcServer32\(Default) = "C:\PROGRA~1\FLASHGET\fgiebar.dll" ["Amaze Soft"]

Explorer Bars

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLM\Software\Classes\CLSID\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}\(Default) = "My Web Search Quick View"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "&FlashGet"
"Exec" = "C:\PROGRA~1\FLASHGET\flashget.exe" ["Amaze Soft"]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Diskeeper, Diskeeper, ""C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe"" ["Diskeeper Corporation"]
ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]
LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
NVIDIA Display Driver Service (Omega 1.6177) (Q), NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
StarWind iSCSI Service, StarWindService, "D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
hpzsnt08\Driver = "hpzsnt08.dll" ["HP"]

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 52 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 27 seconds.
---------- (total run time: 111 seconds)

**Posty:** 8694 · przez **Red** 01 Sie 2006, 09:21

mam jeszcze pyatnie ,czy ty uzuwasz outlook i masz go w autostarcie???Wazne ,odpowiedz.

**Posty:** 8079 · przez **kajtekjr** 01 Sie 2006, 10:41

Red napisał(a):mam jeszcze pyatnie ,czy ty uzuwasz outlook i masz go w autostarcie???Wazne ,odpowiedz.

Outlook nie uzywam, bo mam The Bat i Mozilla Thunderbird, ale jest w zakładce uruchamiane (zaznaczone jako aktywne) jak wpisze w Uruchom>> mscofing

prosze o sprawdzenie loga :)

Prosze o sprawdzenie loga :)

Kto jest na forum