prosze o sprawdzenie loga

[wojtas]

nie , a trzeba?

tak zrob a awaryjnym

[FastMan]

to samo jest w awaryjnym

[Aqui]

To z wyrejestrowywaniem plikow tez probowales w awaryjnym..?

[FastMan]

tak , i jest to samo co normalnie

[Red]

FastMan sciagnij GMER

http://www.wiruskill.pl/forum/viewtopic.php?t=53

W zakładce Rootkit >>>masz miec zaznaczone wszystko do skanu oprocz> Pokazuj wszystko.Nastepnie >>> Szukaj >>> Kopiuj >>> Ctr + V do posta.

[FastMan]

[code]GMER 1.0.11.11390 - http://www.gmer.net
Rootkit 2006-10-29 13:40:41
Windows 5.1.2600 Dodatek Service Pack 2


---- System - GMER 1.0.11 ----

SSDT Vax347b.sys ZwClose
SSDT Vax347b.sys ZwCreateKey
SSDT Vax347b.sys ZwCreatePagingFile
SSDT Vax347b.sys ZwEnumerateKey
SSDT Vax347b.sys ZwEnumerateValueKey
SSDT Vax347b.sys ZwOpenKey
SSDT Vax347b.sys ZwQueryKey
SSDT Vax347b.sys ZwQueryValueKey
SSDT Vax347b.sys ZwSetSystemPowerState
SSDT sptd.sys ZwSetValueKey

---- Devices - GMER 1.0.11 ----

Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA 823701D8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_PNP 823701D8
Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_CREATE 82062990
Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_CLOSE 82062990
Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_DEVICE_CONTROL 82062990
Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82062990
Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_POWER 82062990
Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_SYSTEM_CONTROL 82062990
Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_PNP 82062990
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CREATE 823721D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CLOSE 823721D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_READ 823721D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_WRITE 823721D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_FLUSH_BUFFERS 823721D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_DEVICE_CONTROL 823721D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_INTERNAL_DEVICE_CONTROL 823721D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SHUTDOWN 823721D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_POWER 823721D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SYSTEM_CONTROL 823721D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_PNP 823721D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CREATE 823721D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CLOSE 823721D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_READ 823721D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_WRITE 823721D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_FLUSH_BUFFERS 823721D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_DEVICE_CONTROL 823721D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_INTERNAL_DEVICE_CONTROL 823721D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_SHUTDOWN 823721D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_POWER 823721D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_SYSTEM_CONTROL 823721D8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_PNP 823721D8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CREATE 823721D8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CLOSE 823721D8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_READ 823721D8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_WRITE 823721D8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_FLUSH_BUFFERS 823721D8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_DEVICE_CONTROL 823721D8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_INTERNAL_DEVICE_CONTROL 823721D8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_SHUTDOWN 823721D8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_POWER 823721D8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_SYSTEM_CONTROL 823721D8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_PNP 823721D8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CREATE 823721D8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CLOSE 823721D8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_READ 823721D8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_WRITE 823721D8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_FLUSH_BUFFERS 823721D8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_DEVICE_CONTROL 823721D8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_INTERNAL_DEVICE_CONTROL 823721D8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_SHUTDOWN 823721D8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_POWER 823721D8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_SYSTEM_CONTROL 823721D8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_PNP 823721D8
Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_CREATE 82062990
Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_CLOSE 82062990
Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_DEVICE_CONTROL 82062990
Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_INTERNAL_DEVICE_CONTROL 82062990
Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_POWER 82062990
Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_SYSTEM_CONTROL 82062990
Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_PNP 82062990
Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_CREATE 82062990
Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_CLOSE 82062990
Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_DEVICE_CONTROL 82062990
Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_INTERNAL_DEVICE_CONTROL 82062990
Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_POWER 82062990
Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_SYSTEM_CONTROL 82062990
Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_PNP 82062990
Device \Driver\usbehci \Device\USBPDO-3 IRP_MJ_CREATE 81FE1740
Device \Driver\usbehci \Device\USBPDO-3 IRP_MJ_CLOSE 81FE1740
Device \Driver\usbehci \Device\USBPDO-3 IRP_MJ_DEVICE_CONTROL 81FE1740
Device \Driver\usbehci \Device\USBPDO-3 IRP_MJ_INTERNAL_DEVICE_CONTROL 81FE1740
Device \Driver\usbehci \Device\USBPDO-3 IRP_MJ_POWER 81FE1740
Device \Driver\usbehci \Device\USBPDO-3 IRP_MJ_SYSTEM_CONTROL 81FE1740
Device \Driver\usbehci \Device\USBPDO-3 IRP_MJ_PNP 81FE1740
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CREATE 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_READ 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_WRITE 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_FLUSH_BUFFERS 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_DEVICE_CONTROL 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_INTERNAL_DEVICE_CONTROL 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SHUTDOWN 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CLEANUP 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_POWER 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SYSTEM_CONTROL 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_PNP 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CREATE 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_READ 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_WRITE 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_FLUSH_BUFFERS 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_DEVICE_CONTROL 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_INTERNAL_DEVICE_CONTROL 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SHUTDOWN 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CLEANUP 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_POWER 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SYSTEM_CONTROL 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_PNP 823D91D8
Device \Driver\NetBT \Device\NetBT_Tcpip_{D378EC38-67FD-4B0D-9789-151ABB3315BB} IRP_MJ_CREATE 81F8A990
Device \Driver\NetBT \Device\NetBT_Tcpip_{D378EC38-67FD-4B0D-9789-151ABB3315BB} IRP_MJ_CLOSE 81F8A990
Device \Driver\NetBT \Device\NetBT_Tcpip_{D378EC38-67FD-4B0D-9789-151ABB3315BB} IRP_MJ_DEVICE_CONTROL 81F8A990
Device \Driver\NetBT \Device\NetBT_Tcpip_{D378EC38-67FD-4B0D-9789-151ABB3315BB} IRP_MJ_INTERNAL_DEVICE_CONTROL 81F8A990
Device \Driver\NetBT \Device\NetBT_Tcpip_{D378EC38-67FD-4B0D-9789-151ABB3315BB} IRP_MJ_CLEANUP 81F8A990
Device \Driver\NetBT \Device\NetBT_Tcpip_{D378EC38-67FD-4B0D-9789-151ABB3315BB} IRP_MJ_PNP 81F8A990
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_NAMED_PIPE 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_INFORMATION 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_INFORMATION 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_EA 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_EA 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_VOLUME_INFORMATION 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_VOLUME_INFORMATION 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DIRECTORY_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FILE_SYSTEM_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_LOCK_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLEANUP 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_MAILSLOT 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_SECURITY 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_SECURITY 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CHANGE 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_QUOTA 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_QUOTA 8214C518
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 8214C518
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_READ 81EFF248
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CREATE 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_READ 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_WRITE 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_FLUSH_BUFFERS 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_DEVICE_CONTROL 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_INTERNAL_DEVICE_CONTROL 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_SHUTDOWN 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CLEANUP 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_POWER 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_SYSTEM_CONTROL 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_PNP 823D91D8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_NAMED_PIPE 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSE 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_READ 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_INFORMATION 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_INFORMATION 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_EA 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_EA 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_VOLUME_INFORMATION 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_VOLUME_INFORMATION 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DIRECTORY_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FILE_SYSTEM_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_LOCK_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLEANUP 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_MAILSLOT 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_SECURITY 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_SECURITY 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CHANGE 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_QUOTA 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_QUOTA 8214C518
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 8214C518
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_CREATE 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_CREATE_NAMED_PIPE 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_CLOSE 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_READ 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_WRITE 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_QUERY_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_SET_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_QUERY_EA 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_SET_EA 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_FLUSH_BUFFERS 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_QUERY_VOLUME_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_SET_VOLUME_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_DIRECTORY_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_FILE_SYSTEM_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_DEVICE_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_INTERNAL_DEVICE_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_SHUTDOWN 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_LOCK_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_CLEANUP 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_CREATE_MAILSLOT 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_QUERY_SECURITY 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_SET_SECURITY 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_POWER 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_SYSTEM_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_DEVICE_CHANGE 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_QUERY_QUOTA 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_SET_QUOTA 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_PNP 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE_NAMED_PIPE 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CLOSE 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_READ 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_WRITE 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_EA 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_EA 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_FLUSH_BUFFERS 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_VOLUME_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_VOLUME_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DIRECTORY_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_FILE_SYSTEM_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DEVICE_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_INTERNAL_DEVICE_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SHUTDOWN 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_LOCK_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CLEANUP 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE_MAILSLOT 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_SECURITY 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_SECURITY 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_POWER 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SYSTEM_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DEVICE_CHANGE 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_QUOTA 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_QUOTA 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_PNP 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_NAMED_PIPE 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLOSE 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_READ 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_WRITE 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_EA 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_EA 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FLUSH_BUFFERS 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_VOLUME_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_VOLUME_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DIRECTORY_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FILE_SYSTEM_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_INTERNAL_DEVICE_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SHUTDOWN 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_LOCK_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLEANUP 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_MAILSLOT 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_SECURITY 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_SECURITY 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_POWER 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SYSTEM_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CHANGE 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_QUOTA 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_QUOTA 81EB2008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_PNP 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE_NAMED_PIPE 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLOSE 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_READ 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_WRITE 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_EA 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_EA 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_FLUSH_BUFFERS 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_VOLUME_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_VOLUME_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DIRECTORY_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_FILE_SYSTEM_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_INTERNAL_DEVICE_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SHUTDOWN 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_LOCK_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLEANUP 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE_MAILSLOT 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_SECURITY 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_SECURITY 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_POWER 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SYSTEM_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CHANGE 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_QUOTA 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_QUOTA 81EB2008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_PNP 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_CREATE 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_CREATE_NAMED_PIPE 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_CLOSE 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_READ 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_WRITE 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_QUERY_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_SET_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_QUERY_EA 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_SET_EA 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_FLUSH_BUFFERS 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_QUERY_VOLUME_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_SET_VOLUME_INFORMATION 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_DIRECTORY_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_FILE_SYSTEM_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_DEVICE_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_INTERNAL_DEVICE_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_SHUTDOWN 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_LOCK_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_CLEANUP 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_CREATE_MAILSLOT 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_QUERY_SECURITY 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_SET_SECURITY 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_POWER 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_SYSTEM_CONTROL 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_DEVICE_CHANGE 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_QUERY_QUOTA 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_SET_QUOTA 81EB2008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_PNP 81EB2008
Device \Driver\Ftdisk \Device\HarddiskVolume4 IRP_MJ_CREATE 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume4 IRP_MJ_READ 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume4 IRP_MJ_WRITE 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume4 IRP_MJ_FLUSH_BUFFERS 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume4 IRP_MJ_DEVICE_CONTROL 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume4 IRP_MJ_INTERNAL_DEVICE_CONTROL 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume4 IRP_MJ_SHUTDOWN 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume4 IRP_MJ_CLEANUP 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume4 IRP_MJ_POWER 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume4 IRP_MJ_SYSTEM_CONTROL 823D91D8
Device \Driver\Ftdisk \Device\HarddiskVolume4 IRP_MJ_PNP 823D91D8
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE_NAMED_PIPE 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CLOSE 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_READ 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_WRITE 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_INFORMATION 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_INFORMATION 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_EA 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_EA 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_FLUSH_BUFFERS 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_VOLUME_INFORMATION 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_VOLUME_INFORMATION 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DIRECTORY_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_FILE_SYSTEM_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DEVICE_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_INTERNAL_DEVICE_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SHUTDOWN 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_LOCK_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CLEANUP 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE_MAILSLOT 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_SECURITY 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_SECURITY 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_POWER 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SYSTEM_CONTROL 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DEVICE_CHANGE 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_QUOTA 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_QUOTA 8214C518
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_PNP 8214C518
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CREATE 81F8A990
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLOSE 81F8A990
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_DEVICE_CONTROL 81F8A990
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_INTERNAL_DEVICE_CONTROL 81F8A990
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLEANUP 81F8A990
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_PNP 81F8A990
Device \Driver\00000040 \Device\0000004b IRP_MJ_POWER [F845ADB6] sptd.sys
Device \Driver\00000040 \Device\0000004b IRP_MJ_SYSTEM_CONTROL [F847073C] sptd.sys
Device \Driver\00000040 \Device\0000004b IRP_MJ_PNP [F846977E] sptd.sys
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CREATE 81F8A990
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLOSE 81F8A990
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_DEVICE_CONTROL 81F8A990
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_INTERNAL_DEVICE_CONTROL 81F8A990
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLEANUP 81F8A990
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_PNP 81F8A990
Device \FileSystem\Srv \Device\LanmanServer IRP_MJ_READ 81F68130
Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_CREATE 82062990
Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_CLOSE 82062990
Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_DEVICE_CONTROL 82062990
Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82062990
Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_POWER 82062990
Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_SYSTEM_CONTROL 82062990
Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_PNP 82062990
Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_CREATE 82062990
Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_CLOSE 82062990
Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_DEVICE_CONTROL 82062990
Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_INTERNAL_DEVICE_CONTROL 82062990
Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_POWER 82062990
Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_SYSTEM_CONTROL 82062990
Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_PNP 82062990
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_NAMED_PIPE 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLOSE 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_READ 82098928
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_WRITE 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_INFORMATION 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_INFORMATION 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_EA 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_EA 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FLUSH_BUFFERS 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_VOLUME_INFORMATION 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_VOLUME_INFORMATION 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DIRECTORY_CONTROL 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FILE_SYSTEM_CONTROL 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CONTROL 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_INTERNAL_DEVICE_CONTROL 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SHUTDOWN 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_LOCK_CONTROL 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLEANUP 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_MAILSLOT 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_SECURITY 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_SECURITY 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_POWER 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SYSTEM_CONTROL 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CHANGE 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_QUOTA 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_QUOTA 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_PNP 81DB81D8
Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_CREATE 82062990
Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_CLOSE 82062990
Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_DEVICE_CONTROL 82062990
Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_INTERNAL_DEVICE_CONTROL 82062990
Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_POWER 82062990
Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_SYSTEM_CONTROL 82062990
Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_PNP 82062990
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_NAMED_PIPE 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLOSE 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_READ 82098928
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_WRITE 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_INFORMATION 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_INFORMATION 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_EA 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_EA 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FLUSH_BUFFERS 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_VOLUME_INFORMATION 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_VOLUME_INFORMATION 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DIRECTORY_CONTROL 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FILE_SYSTEM_CONTROL 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CONTROL 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_INTERNAL_DEVICE_CONTROL 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SHUTDOWN 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_LOCK_CONTROL 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLEANUP 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_MAILSLOT 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_SECURITY 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_SECURITY 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_POWER 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SYSTEM_CONTROL 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CHANGE 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_QUOTA 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_QUOTA 81DB81D8
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_PNP 81DB81D8
Device \Driver\usbehci \Device\USBFDO-3 IRP_MJ_CREATE 81FE1740
Device \Driver\usbehci \Device\USBFDO-3 IRP_MJ_CLOSE 81FE1740
Device \Driver\usbehci \Device\USBFDO-3 IRP_MJ_DEVICE_CONTROL 81FE1740
Device \Driver\usbehci \Device\USBFDO-3 IRP_MJ_INTERNAL_DEVICE_CONTROL 81FE1740
Device \Driver\usbehci \Device\USBFDO-3 IRP_MJ_POWER 81FE1740
Device \Driver\usbehci \Device\USBFDO-3 IRP_MJ_SYSTEM_CONTROL 81FE1740
Device \Driver\usbehci \Device\USBFDO-3 IRP_MJ_PNP 81FE1740
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_READ 8209DB68
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_CREATE 823D91D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_READ 823D91D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_WRITE 823D91D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_FLUSH_BUFFERS 823D91D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_DEVICE_CONTROL 823D91D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_INTERNAL_DEVICE_CONTROL 823D91D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_SHUTDOWN 823D91D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_CLEANUP 823D91D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_POWER 823D91D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_SYSTEM_CONTROL 823D91D8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_PNP 823D91D8
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_READ 82063F10
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_CREATE 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_CREATE_NAMED_PIPE 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_CLOSE 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_READ 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_WRITE 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_QUERY_INFORMATION 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_SET_INFORMATION 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_QUERY_EA 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_SET_EA 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_FLUSH_BUFFERS 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_QUERY_VOLUME_INFORMATION 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_SET_VOLUME_INFORMATION 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_DIRECTORY_CONTROL 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_FILE_SYSTEM_CONTROL 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_DEVICE_CONTROL 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_SHUTDOWN 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_LOCK_CONTROL 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_CLEANUP 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_CREATE_MAILSLOT 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_QUERY_SECURITY 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_SET_SECURITY 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_POWER 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_SYSTEM_CONTROL 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_DEVICE_CHANGE 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_QUERY_QUOTA 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_SET_QUOTA 81E55008
Device \Driver\an509fyj \Device\Scsi\an509fyj1Port3Path0Target0Lun0 IRP_MJ_PNP 81E55008
Device \Driver\Vax347s \Device\Scsi\Vax347s1 IRP_MJ_CREATE 8212C008
Device \Driver\Vax347s \Device\Scsi\Vax347s1 IRP_MJ_CREATE_NAMED_PIPE 8212C008
Device \Driver\Vax347s \Device\Scsi\Vax347s1 IRP_MJ_CLOSE 8212C008
Device \Driver\Vax347s \Device\Scsi\Vax347s1 IRP_MJ_READ 8212C008
Device \Driver\Vax347s \Device\Scsi\Vax347s1 IRP_MJ_WRITE 8212C008
Device \Driver\Vax347s \Device\Scsi\Vax347s1 IRP_MJ_QUERY_INFORMATION 8212C008
Device \Driver\Vax347s \Device\Scsi\Vax347s1 IRP_MJ_SET_INFORMATION 8212C008
Device \Driver\Vax347s \Device\Scsi\Vax347s1 IRP_MJ_QUERY_EA 8212C008
Device \Driver\Vax347s \Device\Scsi\Vax347s1 IRP_MJ_SET_EA 8212C008
Device \Driver\Vax347s \Device\Scsi\Vax347s1 IRP_MJ_FLUSH_BUFFERS

[Red]

1. W Gmerze działasz :


- w zakładce CMD >>> CMD wklej:

gmer -killall
gmer -del file C:\WINDOWS\SYSTEM32\winjjq32.dll
gmer -del file C:\WINDOWS\SYSTEM32\dxclib303562752.dll
gmer -reboot

i klikasz na uruchom .....

[FastMan]

przed wyłączeniem kompa pojawiło mi się coś że nie można usunąć pliku dxclib303562752.dll (jakoś tak)

[Red]

wiec daj log z hijacka

[FastMan]

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 16:20:31, on 2006-10-30
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox 2 Beta 2\firefox.exe
D:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: dxclib303562752.dll
O20 - Winlogon Notify: winjjq32 - winjjq32.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe



[Red]

w hijacku usuniesz:

O20 - Winlogon Notify: winjjq32 - winjjq32.dll (file missing)

w gmer:

w zakładce CMD >>> CMD wklej:

RD /S /Q C:\Program Files\DeluxeCommunications
DEL dxclib303562752.dll

w zakładce Procesy wybierz opcję Zabij wszystko a po tym wróć do zakładki CMD i kliknij na Uruchom

[FastMan]

zrobiłem to i pojawiło mi sie tam na dole że nie można znaleść określonego pliku dxclib303562752.dll , jakoś tak

[Red]

rozumiem ze w logu dalej widzisz to cenzura:

DeluxeCommunications????

Podobno ewido daje sobie z tym radę:
Sciagnij i przeskanuj tym:
http://www.ewido.net/en/
usun wszystko co znajdzie..

Autor postu otrzymał pochwałę

[FastMan]

odrazu po zainstalowaniu(nawet skanowania nie włączyłem)znalazło mi ten pliczek , usunełem i usunełem ten folder w program files , zrobiłem skanowanie i znalazło mi ponad 140 wirusów. Mam pytanie jakie oprogramowanie (niekoniecznie darmowe) polecicie mi do ochrony kompa(bo narazie używam avasta i ad-aware , co myślicie o Kasperskym?

[Aqui]

Kaspersky-b.dobry ale obciaza kompa
Dobry nie darmowy nie obciazajacy kompa-nod32
Zamiast adaware ,lepiej czasami zrobic skan Ewido
Daj jeszcze kontrolne logi

[FastMan]

Przygotowałem parę programów , jak myślici , ktróy lepszy , czy może polecicie jakiegoś innego:

-Kasperky Anti-Virus Personal Pro
-Kaspersky Anti-Virus 6.0.0.300
-Kaspersky 5.0.527
-Nod32 2.51.30
-Symantec Norton Antivirus 2007(jakoś nigdy nie przekonałem się do tego rpogramu)
-McAfee VirusScan PLUS 2007

Ta lista dotyczy antywirusów , a jakiego dodatkowe programy doradzicie?

[ Dodano: Dzisiaj o 16:26 ]
z jaki programów dać logi?

[wojtas]

z jaki programów dać logi?

hijack i sillent runners

[snajper$]

Polecam AntiVir Personal Edition bardzo dobry program antywirusowy więcej info na www.antivir-polska.info

[FastMan]

Zainstalowałem tamtego nod32


Logi:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 16:53:05, on 2006-10-31
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Eset\nod32.exe
C:\Program Files\Mozilla Firefox 2 Beta 2\firefox.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
D:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: dxclib303562752.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe



Kod: Zaznacz wszystko

"Silent Runners.vbs", revision 49, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data]
"(Default)" = "(empty string)" [file not found]
"ATICCC" = ""C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime" [null data]
"ISUSPM Startup" = "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup" ["InstallShield Software Corporation"]
"ISUSScheduler" = ""C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start" ["InstallShield Software Corporation"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."]
"LanguageShortcut" = ""C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"" [null data]
"!AVG Anti-Spyware" = ""C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized" ["Anti-Malware Development a.s."]
"nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "AcroIEHlprObj Class"
                   \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "SSVHelper Class"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
  -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
                   \InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
  -> {HKLM...CLSID} = "avast"
                   \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
  -> {HKLM...CLSID} = "AlcoholShellEx"
                   \InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
  -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
"{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}" = "TuneUp Shredder Shell Context Menu Extension"
  -> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"
                   \InProcServer32\(Default) = ""C:\Program Files\TuneUp Utilities 2006\sdshelex.dll"" ["TuneUp Software GmbH"]
"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension"
  -> {HKLM...CLSID} = "SimpleShlExt Class"
                   \InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string]
"{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension"
  -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5"
  -> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\
<<!>> "AppInit_DLLs" = "dxclib303562752.dll" [file not found]

HKLM\System\CurrentControlSet\Control\Session Manager\
<<!>> "BootExecute" = "PDBoot.exe" ["Raxco Software, Inc."]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
  -> {HKLM...CLSID} = "avast"
                   \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
  -> {HKLM...CLSID} = "CContextScan Object"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."]
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
  -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
TuneUp Shredder\(Default) = "{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}"
  -> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"
                   \InProcServer32\(Default) = ""C:\Program Files\TuneUp Utilities 2006\sdshelex.dll"" ["TuneUp Software GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
  -> {HKLM...CLSID} = "CContextScan Object"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."]
TuneUp Shredder\(Default) = "{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}"
  -> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"
                   \InProcServer32\(Default) = ""C:\Program Files\TuneUp Utilities 2006\sdshelex.dll"" ["TuneUp Software GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
  -> {HKLM...CLSID} = "avast"
                   \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
  -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"DisableRegistryTools" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|System|
Prevent access to registry editing tools}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\FastMan\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"


Startup items in "FastMan" & "All Users" startup folders:
---------------------------------------------------------

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"ATI CATALYST System Tray" -> shortcut to: "C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe SystemTray" [null data]


Enabled Scheduled Tasks:
------------------------

"1-Click Maintenance" -> launches: "C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe /schedulestart" ["TuneUp Software GmbH"]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 17
%SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 16
%SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{327C2873-E90D-4C37-AA9D-10AC9BABA46C}" = "Easy-WebPrint"
  -> {HKLM...CLSID} = "Easy-WebPrint"
                   \InProcServer32\(Default) = "C:\Program Files\Canon\Easy-WebPrint\Toolband.dll" [null data]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

HKLM\Software\Classes\CLSID\{03C1C47F-0538-4645-8372-D3109B9FC636}\(Default) = "Easy-WebPrint"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Program Files\Canon\Easy-WebPrint\Toolband.dll" [null data]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
  -> {HKCU...CLSID} = "Java Plug-in"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
  -> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Miscellaneous IE Hijack Points
------------------------------

HKLM\Software\Microsoft\Internet Explorer\AboutURLs\
<<H>> "TuneUp" = "file://C|/Documents and Settings/All Users/Dane aplikacji/TuneUp Software/Common/base.css" [file not found]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data]
AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["Anti-Malware Development a.s."]
Cyberlink RichVideo Service(CRVS), RichVideo, ""C:\Program Files\CyberLink\Shared files\RichVideo.exe"" [empty string]
NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "]
PDAgent, PDAgent, ""C:\Program Files\Raxco\PerfectDisk\PDAgent.exe"" ["Raxco Software, Inc."]
SecuROM User Access Service (V7), UserAccess7, "C:\WINDOWS\system32\UAService7.exe" ["Sony DADC Austria AG."]
StarWind iSCSI Service, StarWindService, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]
TuneUp WinStyler Theme Service, TUWinStylerThemeSvc, ""C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe"" ["TuneUp Software GmbH"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]


----------
<<!>>: Suspicious data at a malware launch point.
<<H>>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
  took 133 seconds.
---------- (total run time: 204 seconds)


[Red]

Widze ze jest juz o niebo lepiej,głowny smiec poleciał,ale zostawił swoją dll`kę

O20 - AppInit_DLLs: dxclib303562752.dll

Zaznacz whijacku i usuń,jesli nie pójdzie to prosze sciagnać:

RegSrch.zip

http://www.wiruskill.pl/forum/viewtopic.php?t=58

wklej w nim na wyszukiwanie>>> dxclib303562752.dll i daj wynik na forum...