przez wojtas 31 Sty 2007, 21:33
przez Wariat 31 Sty 2007, 22:20
"Administrator" - 07-01-31 21:00:45 Dodatek Service Pack 2
ComboFix 07.01.31 - Running from: "C:\Documents and Settings\Administrator\Pulpit"
((((((((((((((((((((((((((((((( Files Created from 2006-12-31 to 2007-01-31 ))))))))))))))))))))))))))))))))))
2007-01-31 20:55 <DIR> d-------- C:\WINDOWS\Content.IE5
2007-01-31 19:25 1,930 --a------ C:\WINDOWS\system32\tmp.reg
2007-01-31 19:24 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe
2007-01-31 19:24 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-01-31 19:24 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-01-31 19:24 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2007-01-31 19:24 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-01-31 19:24 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2007-01-31 18:32 <DIR> d-------- C:\avenger
2007-01-31 18:23 60,416 --a------ C:\WINDOWS\system32\drivers\ghnum^vh.sys
2007-01-31 09:09 33,920 --a------ C:\WINDOWS\system32\main.sys
2007-01-30 22:11 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-01-30 22:11 <DIR> d-------- C:\Program Files\Grisoft
2007-01-30 22:00 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\stamina
2007-01-30 18:58 2,816 --a------ C:\WINDOWS\system32\reg.sys
2007-01-30 18:56 169,984 --a------ C:\WINDOWS\system32\oajuj.dll
2007-01-30 18:56 169,984 --a------ C:\WINDOWS\system32\ezhipxp.dll
2007-01-30 18:55 169,984 --a------ C:\WINDOWS\system32\wqmzqv.dll
2007-01-30 17:53 8,138 --a------ C:\syst.exe
2007-01-30 17:53 8,138 --a------ C:\3456346345643.exe
2007-01-28 22:18 <DIR> d-------- C:\!KillBox
2007-01-28 20:04 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-01-28 20:04 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start
2007-01-28 20:04 <DIR> d--hs---- C:\WINDOWS\CSC
2007-01-28 20:04 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-01-28 20:04 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony
2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione
2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit
2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-01-27 15:57 <DIR> d-------- C:\Program Files\DFX
2007-01-27 15:56 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-01-25 15:45 <DIR> d-------- C:\Program Files\uTorrent
2007-01-25 15:45 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\uTorrent
2007-01-20 21:17 <DIR> d-------- C:\Program Files\eMule
2007-01-19 09:19 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2007-01-19 09:19 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2007-01-19 09:19 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-01-13 17:48 <DIR> d-------- C:\Program Files\MegauploadToolbar
2007-01-13 17:48 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\MegauploadToolbar
2007-01-10 20:39 48,128 --a------ C:\WINDOWS\system32\srshostu.exe
2007-01-10 16:48 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\DivX
2007-01-10 16:39 <DIR> d-------- C:\Program Files\StrongDC++
2007-01-09 19:57 <DIR> d-------- C:\Program Files\Samsung ML-2010 Series
2007-01-09 19:55 57,344 --a------ C:\WINDOWS\system32\SSCoInst.dll
2007-01-09 19:55 41,984 --------- C:\WINDOWS\system32\drivers\DGIVECP.SYS
2007-01-09 19:55 208,896 --------- C:\WINDOWS\system32\SSRemove.exe
2007-01-09 19:55 20,622 --a------ C:\WINDOWS\system32\SUGS2LMK.DLL
2007-01-09 19:55 151,552 --a------ C:\WINDOWS\system32\SSCoInst.exe
2007-01-09 19:55 <DIR> d-------- C:\WINDOWS\Samsung
2007-01-09 19:54 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-01-09 19:22 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
2007-01-09 18:44 <DIR> d-------- C:\Program Files\7-Zip
2007-01-09 18:12 <DIR> d-------- C:\Program Files\IrfanView
2007-01-08 23:53 <DIR> d-------- C:\Program Files\Switch Off
2007-01-07 23:47 <DIR> d-------- C:\Program Files\Ontrack
2007-01-03 00:23 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-01-03 00:22 <DIR> d-------- C:\Program Files\Real
2007-01-03 00:22 <DIR> d-------- C:\Program Files\Common Files\Real
2007-01-03 00:21 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\Real
2007-01-03 00:18 <DIR> d-------- C:\My Downloads
2007-01-03 00:15 <DIR> d-------- C:\Program Files\Super Internet TV
2007-01-03 00:05 <DIR> d-------- C:\Program Files\Fma
2007-01-03 00:05 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\FMA
2007-01-02 23:52 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\Ahead
2007-01-02 23:49 <DIR> d-------- C:\Program Files\Nero
2007-01-02 23:49 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-01-02 23:49 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Dane aplikacji\Nero
2007-01-02 22:44 32,782 -ra------ C:\WINDOWS\system32\drivers\ser120.sys
2007-01-02 22:34 <DIR> d-------- C:\Program Files\Usb to Serial Driver 1.12.25
2006-12-31 10:21 <DIR> d-------- C:\Program Files\ToneGen
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-01-31 19:29 -------- d-------- C:\Program Files\mozilla firefox
2007-01-31 18:37 508416 --a------ C:\WINDOWS\system32\winlogon.exe
2007-01-31 00:21 -------- d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\macromedia
2007-01-30 19:21 -------- d---s---- C:\DOCUME~1\ADMINI~1\Dane aplikacji\microsoft
2007-01-28 20:05 -------- d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\mozilla
2007-01-09 19:57 -------- d--h----- C:\Program Files\installshield installation information
2007-01-09 19:57 -------- d-------- C:\Program Files\Common Files\installshield
2007-01-09 18:54 -------- d-------- C:\Program Files\subedit-player
2007-01-03 00:22 -------- d-------- C:\Program Files\google
2006-12-30 22:40 -------- d-------- C:\Program Files\skype
2006-12-30 22:40 -------- d-------- C:\Program Files\Common Files\skype
2006-12-22 16:35 -------- d-------- C:\Program Files\winamp
2006-12-20 21:48 -------- d-------- C:\Program Files\java
2006-12-20 21:44 -------- d-------- C:\Program Files\Common Files\java
2006-12-19 19:02 -------- d-------- C:\Program Files\kaspersky lab
2006-12-19 17:10 -------- d-------- C:\Program Files\c-media 3d audio
2006-12-19 17:08 -------- d-------- C:\Program Files\Common Files\speechengines
2006-12-19 17:08 -------- d-------- C:\Program Files\Common Files\odbc
2006-12-19 17:07 62 --ahs---- C:\DOCUME~1\ADMINI~1\Dane aplikacji\desktop.ini
2006-12-19 16:52 -------- d-------- C:\Program Files\konnekt
2006-12-19 16:22 -------- d-------- C:\Program Files\microsoft frontpage
2006-12-19 16:21 0 -rahs---- C:\MSDOS.SYS
2006-12-19 16:21 0 -rahs---- C:\IO.SYS
2006-12-19 16:21 0 --a------ C:\CONFIG.SYS
2006-12-19 16:21 0 --a------ C:\AUTOEXEC.BAT
2006-12-19 16:19 -------- d--h----- C:\Program Files\windowsupdate
2006-12-19 16:19 -------- d-------- C:\Program Files\usˆugi online
2006-12-19 16:18 -------- d-------- C:\Program Files\movie maker
2006-12-19 16:18 -------- d-------- C:\Program Files\Common Files\mssoap
2006-12-19 16:16 -------- d-------- C:\Program Files\windows nt
2006-12-19 16:16 -------- d-------- C:\Program Files\msn gaming zone
2006-12-19 16:16 -------- d-------- C:\Program Files\messenger
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"NeroHomeFirstStart"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NMFirstStart.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"DU Meter"="C:\\Program Files\\DU Meter\\DUMeter.exe"
"Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"KAVPersonal50"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus Personal Pro\\kav.exe\" /minimize"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\""
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"
"NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe"
"Samsung Common SM"="\"C:\\WINDOWS\\Samsung\\ComSMMgr\\ssmmgr.exe\" /autorun"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{2C1CD3D7-86AC-4068-93BC-A02304B60787}"="DCOM Server 60787"
"{2C1CD3D7-86AC-4068-93BC-A02304B37389}"="DCOM Server 37389"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"=dword:00000000
"NoColorChoice"=dword:00000000
"NoSizeChoice"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
"NoDispScrSavPage"=dword:00000000
"NoDispCPL"=dword:00000000
"NoVisualStyleChoice"=dword:00000000
"NoDispSettingsPage"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktopChanges"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSaveSettings"=dword:00000000
"NoThemesTab"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
Shell\AutoRun\command D:\SETUP.EXE
Completion time: 07-01-31 21:10:59
C:\ComboFix2.txt ... 07-01-31 20:14
C:\ComboFix3.txt ... 07-01-31 19:47
przez Aqui 31 Sty 2007, 23:08
C:\!KillBox
C:\Avenger\backup.zip
Files to delete:
C:\WINDOWS\system32\oajuj.dll
C:\WINDOWS\system32\ezhipxp.dll
C:\WINDOWS\system32\wqmzqv.dll
C:\WINDOWS\system32\srshostu.exe
przez Wariat 31 Sty 2007, 23:55
"Administrator" - 07-01-31 22:28:48 Dodatek Service Pack 2
ComboFix 07.01.31 - Running from: "C:\Documents and Settings\Administrator\Pulpit"
((((((((((((((((((((((((((((((( Files Created from 2006-12-31 to 2007-01-31 ))))))))))))))))))))))))))))))))))
2007-01-31 22:16 60,416 --a------ C:\WINDOWS\system32\drivers\nlxlnvqu.sys
2007-01-31 22:16 126,976 --a------ C:\zip.exe
2007-01-31 22:16 1,080 --a------ C:\yvnlrlxl.bat
2007-01-31 20:55 <DIR> d-------- C:\WINDOWS\Content.IE5
2007-01-31 19:25 1,930 --a------ C:\WINDOWS\system32\tmp.reg
2007-01-31 19:24 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe
2007-01-31 19:24 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-01-31 19:24 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-01-31 19:24 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2007-01-31 19:24 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-01-31 19:24 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2007-01-31 18:32 <DIR> d-------- C:\avenger
2007-01-31 18:23 60,416 --a------ C:\WINDOWS\system32\drivers\ghnum^vh.sys
2007-01-31 09:09 33,920 --a------ C:\WINDOWS\system32\main.sys
2007-01-30 22:11 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-01-30 22:11 <DIR> d-------- C:\Program Files\Grisoft
2007-01-30 22:00 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\stamina
2007-01-30 18:58 2,816 --a------ C:\WINDOWS\system32\reg.sys
2007-01-30 17:53 8,138 --a------ C:\syst.exe
2007-01-30 17:53 8,138 --a------ C:\3456346345643.exe
2007-01-28 20:04 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-01-28 20:04 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start
2007-01-28 20:04 <DIR> d--hs---- C:\WINDOWS\CSC
2007-01-28 20:04 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-01-28 20:04 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony
2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione
2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit
2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-01-27 15:57 <DIR> d-------- C:\Program Files\DFX
2007-01-27 15:56 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-01-25 15:45 <DIR> d-------- C:\Program Files\uTorrent
2007-01-25 15:45 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\uTorrent
2007-01-20 21:17 <DIR> d-------- C:\Program Files\eMule
2007-01-19 09:19 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2007-01-19 09:19 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2007-01-19 09:19 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-01-13 17:48 <DIR> d-------- C:\Program Files\MegauploadToolbar
2007-01-13 17:48 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\MegauploadToolbar
2007-01-10 16:48 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\DivX
2007-01-10 16:39 <DIR> d-------- C:\Program Files\StrongDC++
2007-01-09 19:57 <DIR> d-------- C:\Program Files\Samsung ML-2010 Series
2007-01-09 19:55 57,344 --a------ C:\WINDOWS\system32\SSCoInst.dll
2007-01-09 19:55 41,984 --------- C:\WINDOWS\system32\drivers\DGIVECP.SYS
2007-01-09 19:55 208,896 --------- C:\WINDOWS\system32\SSRemove.exe
2007-01-09 19:55 20,622 --a------ C:\WINDOWS\system32\SUGS2LMK.DLL
2007-01-09 19:55 151,552 --a------ C:\WINDOWS\system32\SSCoInst.exe
2007-01-09 19:55 <DIR> d-------- C:\WINDOWS\Samsung
2007-01-09 19:54 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-01-09 19:22 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
2007-01-09 18:44 <DIR> d-------- C:\Program Files\7-Zip
2007-01-09 18:12 <DIR> d-------- C:\Program Files\IrfanView
2007-01-08 23:53 <DIR> d-------- C:\Program Files\Switch Off
2007-01-07 23:47 <DIR> d-------- C:\Program Files\Ontrack
2007-01-03 00:23 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-01-03 00:22 <DIR> d-------- C:\Program Files\Real
2007-01-03 00:22 <DIR> d-------- C:\Program Files\Common Files\Real
2007-01-03 00:21 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\Real
2007-01-03 00:18 <DIR> d-------- C:\My Downloads
2007-01-03 00:15 <DIR> d-------- C:\Program Files\Super Internet TV
2007-01-03 00:05 <DIR> d-------- C:\Program Files\Fma
2007-01-03 00:05 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\FMA
2007-01-02 23:52 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\Ahead
2007-01-02 23:49 <DIR> d-------- C:\Program Files\Nero
2007-01-02 23:49 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-01-02 23:49 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Dane aplikacji\Nero
2007-01-02 22:44 32,782 -ra------ C:\WINDOWS\system32\drivers\ser120.sys
2007-01-02 22:34 <DIR> d-------- C:\Program Files\Usb to Serial Driver 1.12.25
2006-12-31 10:21 <DIR> d-------- C:\Program Files\ToneGen
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-01-31 22:26 -------- d-------- C:\Program Files\mozilla firefox
2007-01-31 18:37 508416 --a------ C:\WINDOWS\system32\winlogon.exe
2007-01-31 00:21 -------- d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\macromedia
2007-01-30 19:21 -------- d---s---- C:\DOCUME~1\ADMINI~1\Dane aplikacji\microsoft
2007-01-28 20:05 -------- d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\mozilla
2007-01-09 19:57 -------- d--h----- C:\Program Files\installshield installation information
2007-01-09 19:57 -------- d-------- C:\Program Files\Common Files\installshield
2007-01-09 18:54 -------- d-------- C:\Program Files\subedit-player
2007-01-03 00:22 -------- d-------- C:\Program Files\google
2006-12-30 22:40 -------- d-------- C:\Program Files\skype
2006-12-30 22:40 -------- d-------- C:\Program Files\Common Files\skype
2006-12-22 16:35 -------- d-------- C:\Program Files\winamp
2006-12-20 21:48 -------- d-------- C:\Program Files\java
2006-12-20 21:44 -------- d-------- C:\Program Files\Common Files\java
2006-12-19 19:02 -------- d-------- C:\Program Files\kaspersky lab
2006-12-19 17:10 -------- d-------- C:\Program Files\c-media 3d audio
2006-12-19 17:08 -------- d-------- C:\Program Files\Common Files\speechengines
2006-12-19 17:08 -------- d-------- C:\Program Files\Common Files\odbc
2006-12-19 17:07 62 --ahs---- C:\DOCUME~1\ADMINI~1\Dane aplikacji\desktop.ini
2006-12-19 16:52 -------- d-------- C:\Program Files\konnekt
2006-12-19 16:22 -------- d-------- C:\Program Files\microsoft frontpage
2006-12-19 16:21 0 -rahs---- C:\MSDOS.SYS
2006-12-19 16:21 0 -rahs---- C:\IO.SYS
2006-12-19 16:21 0 --a------ C:\CONFIG.SYS
2006-12-19 16:21 0 --a------ C:\AUTOEXEC.BAT
2006-12-19 16:19 -------- d--h----- C:\Program Files\windowsupdate
2006-12-19 16:19 -------- d-------- C:\Program Files\usˆugi online
2006-12-19 16:18 -------- d-------- C:\Program Files\movie maker
2006-12-19 16:18 -------- d-------- C:\Program Files\Common Files\mssoap
2006-12-19 16:16 -------- d-------- C:\Program Files\windows nt
2006-12-19 16:16 -------- d-------- C:\Program Files\msn gaming zone
2006-12-19 16:16 -------- d-------- C:\Program Files\messenger
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"NeroHomeFirstStart"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NMFirstStart.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"DU Meter"="C:\\Program Files\\DU Meter\\DUMeter.exe"
"Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"KAVPersonal50"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus Personal Pro\\kav.exe\" /minimize"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\""
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"
"NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe"
"Samsung Common SM"="\"C:\\WINDOWS\\Samsung\\ComSMMgr\\ssmmgr.exe\" /autorun"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"jirbbofm"="C:\\yvnlrlxl.bat"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{2C1CD3D7-86AC-4068-93BC-A02304B60787}"="DCOM Server 60787"
"{2C1CD3D7-86AC-4068-93BC-A02304B37389}"="DCOM Server 37389"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"=dword:00000000
"NoColorChoice"=dword:00000000
"NoSizeChoice"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
"NoDispScrSavPage"=dword:00000000
"NoDispCPL"=dword:00000000
"NoVisualStyleChoice"=dword:00000000
"NoDispSettingsPage"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktopChanges"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSaveSettings"=dword:00000000
"NoThemesTab"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
Shell\AutoRun\command D:\SETUP.EXE
Completion time: 07-01-31 22:43:48
C:\ComboFix2.txt ... 07-01-31 21:10
C:\ComboFix3.txt ... 07-01-31 20:14
[quote="Aqui"]Nadal restart nie w awaryjnym ??[/quote]
przez Aqui 01 Lut 2007, 00:02
C:\syst.exe
C:\3456346345643.exe
C:\zip.exe
C:\yvnlrlxl.bat
przez Wariat 01 Lut 2007, 00:13
coś jeszcze ? dać jakieś logi? załadować łinszajsa normalnie ?AntiVir 7.3.1.33 01.31.2007 no virus found
Authentium 4.93.8 01.30.2007 no virus found
Avast 4.7.936.0 01.31.2007 no virus found
AVG 386 01.31.2007 no virus found
BitDefender 7.2 01.31.2007 no virus found
CAT-QuickHeal 9.00 01.31.2007 no virus found
ClamAV devel-20060426 01.31.2007 no virus found
DrWeb 4.33 01.31.2007 no virus found
eSafe 7.0.14.0 01.31.2007 no virus found
eTrust-InoculateIT 30.4.3361 01.31.2007 no virus found
eTrust-Vet 30.4.3361 01.31.2007 no virus found
Ewido 4.0 01.31.2007 no virus found
Fortinet 2.85.0.0 01.31.2007 no virus found
F-Prot 4.2.1.29 01.30.2007 no virus found
Ikarus T3.1.0.27 01.31.2007 no virus found
Kaspersky 4.0.2.24 01.31.2007 no virus found
McAfee 4953 01.31.2007 no virus found
Microsoft 1.2101 01.31.2007 no virus found
NOD32v2 2024 01.31.2007 no virus found
Norman 5.80.02 01.31.2007 no virus found
Panda 9.0.0.4 01.31.2007 no virus found
Prevx1 V2 01.31.2007 no virus found
Sophos 4.13.0 01.31.2007 no virus found
Sunbelt 2.2.907.0 01.31.2007 no virus found
Symantec 10 01.30.2007 no virus found
TheHacker 6.0.3.160 01.31.2007 no virus found
UNA 1.83 01.31.2007 no virus found
VBA32 3.11.2 01.31.2007 no virus found
VirusBuster 4.3.19:9 01.31.2007 no virus found
dalej siedzi Logfile of HijackThis v1.99.1
Scan saved at 00:09:32, on 2007-02-01
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Konnekt\konnekt.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\services.exe
C:\Documents and Settings\KROKU\Pulpit\hijackthis_199\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Samsung Common SM] "C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
O4 - HKCU\..\RunOnce: [NeroHomeFirstStart] C:\Program Files\Common Files\Ahead\Lib\NMFirstStart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
c:\windows\system32\wsys.dll
przez Aqui 01 Lut 2007, 08:07
gmer -killall
gmer -del file c:\windows\system32\wsys.dll
gmer -reboot
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"Wallpaper"=-
Rootkit >>> zaznaczone Pokaż wszystko >>> wskazane tylko Usługi >>> Szukaj >>> Kopiuj >>> CTRL+V do posta
- Rootkit >>> odznaczone Pokaż wszystko >>> wskazane wszystkie obiekty do skanu >>> Szukaj >>> Kopiuj >>> CTRL+V do posta
przez Wariat 01 Lut 2007, 13:30
"Administrator" - 07-02-01 12:03:46 Dodatek Service Pack 2
ComboFix 07.01.31 - Running from: "C:\Documents and Settings\Administrator\Pulpit"
((((((((((((((((((((((((((((((( Files Created from 2007-01-01 to 2007-02-01 ))))))))))))))))))))))))))))))))))
2007-02-01 11:54 80 --a------ C:\WINDOWS\gmer_uninstall.cmd
2007-02-01 11:44 34,176 --a------ C:\WINDOWS\system32\main.sys
2007-01-31 23:11 <DIR> d-------- C:\avenger
2007-01-31 20:55 <DIR> d-------- C:\WINDOWS\Content.IE5
2007-01-31 19:25 1,930 --a------ C:\WINDOWS\system32\tmp.reg
2007-01-31 19:24 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe
2007-01-31 19:24 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-01-31 19:24 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-01-31 19:24 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2007-01-31 19:24 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-01-31 19:24 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2007-01-31 18:23 60,416 --a------ C:\WINDOWS\system32\drivers\ghnum^vh.sys
2007-01-30 22:11 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-01-30 22:11 <DIR> d-------- C:\Program Files\Grisoft
2007-01-30 22:00 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\stamina
2007-01-30 18:58 2,816 --a------ C:\WINDOWS\system32\reg.sys
2007-01-28 20:04 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-01-28 20:04 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start
2007-01-28 20:04 <DIR> d--hs---- C:\WINDOWS\CSC
2007-01-28 20:04 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-01-28 20:04 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony
2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione
2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit
2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-01-27 15:57 <DIR> d-------- C:\Program Files\DFX
2007-01-27 15:56 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-01-25 15:45 <DIR> d-------- C:\Program Files\uTorrent
2007-01-25 15:45 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\uTorrent
2007-01-20 21:17 <DIR> d-------- C:\Program Files\eMule
2007-01-19 09:19 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2007-01-19 09:19 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2007-01-19 09:19 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-01-13 17:48 <DIR> d-------- C:\Program Files\MegauploadToolbar
2007-01-13 17:48 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\MegauploadToolbar
2007-01-10 16:48 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\DivX
2007-01-10 16:39 <DIR> d-------- C:\Program Files\StrongDC++
2007-01-09 19:57 <DIR> d-------- C:\Program Files\Samsung ML-2010 Series
2007-01-09 19:55 57,344 --a------ C:\WINDOWS\system32\SSCoInst.dll
2007-01-09 19:55 41,984 --------- C:\WINDOWS\system32\drivers\DGIVECP.SYS
2007-01-09 19:55 208,896 --------- C:\WINDOWS\system32\SSRemove.exe
2007-01-09 19:55 20,622 --a------ C:\WINDOWS\system32\SUGS2LMK.DLL
2007-01-09 19:55 151,552 --a------ C:\WINDOWS\system32\SSCoInst.exe
2007-01-09 19:55 <DIR> d-------- C:\WINDOWS\Samsung
2007-01-09 19:54 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-01-09 19:22 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
2007-01-09 18:44 <DIR> d-------- C:\Program Files\7-Zip
2007-01-09 18:12 <DIR> d-------- C:\Program Files\IrfanView
2007-01-08 23:53 <DIR> d-------- C:\Program Files\Switch Off
2007-01-07 23:47 <DIR> d-------- C:\Program Files\Ontrack
2007-01-03 00:23 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-01-03 00:22 <DIR> d-------- C:\Program Files\Real
2007-01-03 00:22 <DIR> d-------- C:\Program Files\Common Files\Real
2007-01-03 00:21 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\Real
2007-01-03 00:18 <DIR> d-------- C:\My Downloads
2007-01-03 00:15 <DIR> d-------- C:\Program Files\Super Internet TV
2007-01-03 00:05 <DIR> d-------- C:\Program Files\Fma
2007-01-03 00:05 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\FMA
2007-01-02 23:52 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\Ahead
2007-01-02 23:49 <DIR> d-------- C:\Program Files\Nero
2007-01-02 23:49 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-01-02 23:49 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Dane aplikacji\Nero
2007-01-02 22:44 32,782 -ra------ C:\WINDOWS\system32\drivers\ser120.sys
2007-01-02 22:34 <DIR> d-------- C:\Program Files\Usb to Serial Driver 1.12.25
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-02-01 12:06 -------- d-------- C:\Program Files\mozilla firefox
2007-02-01 11:41 509440 --a------ C:\WINDOWS\system32\winlogon.exe
2007-01-31 00:21 -------- d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\macromedia
2007-01-30 19:21 -------- d---s---- C:\DOCUME~1\ADMINI~1\Dane aplikacji\microsoft
2007-01-28 20:05 -------- d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\mozilla
2007-01-09 19:57 -------- d--h----- C:\Program Files\installshield installation information
2007-01-09 19:57 -------- d-------- C:\Program Files\Common Files\installshield
2007-01-09 18:54 -------- d-------- C:\Program Files\subedit-player
2007-01-03 00:22 -------- d-------- C:\Program Files\google
2006-12-31 10:21 -------- d-------- C:\Program Files\tonegen
2006-12-30 22:40 -------- d-------- C:\Program Files\skype
2006-12-30 22:40 -------- d-------- C:\Program Files\Common Files\skype
2006-12-22 16:35 -------- d-------- C:\Program Files\winamp
2006-12-20 21:48 -------- d-------- C:\Program Files\java
2006-12-20 21:44 -------- d-------- C:\Program Files\Common Files\java
2006-12-19 19:02 -------- d-------- C:\Program Files\kaspersky lab
2006-12-19 17:10 -------- d-------- C:\Program Files\c-media 3d audio
2006-12-19 17:08 -------- d-------- C:\Program Files\Common Files\speechengines
2006-12-19 17:08 -------- d-------- C:\Program Files\Common Files\odbc
2006-12-19 17:07 62 --ahs---- C:\DOCUME~1\ADMINI~1\Dane aplikacji\desktop.ini
2006-12-19 16:52 -------- d-------- C:\Program Files\konnekt
2006-12-19 16:22 -------- d-------- C:\Program Files\microsoft frontpage
2006-12-19 16:21 0 -rahs---- C:\MSDOS.SYS
2006-12-19 16:21 0 -rahs---- C:\IO.SYS
2006-12-19 16:21 0 --a------ C:\CONFIG.SYS
2006-12-19 16:21 0 --a------ C:\AUTOEXEC.BAT
2006-12-19 16:19 -------- d--h----- C:\Program Files\windowsupdate
2006-12-19 16:19 -------- d-------- C:\Program Files\usˆugi online
2006-12-19 16:18 -------- d-------- C:\Program Files\movie maker
2006-12-19 16:18 -------- d-------- C:\Program Files\Common Files\mssoap
2006-12-19 16:16 -------- d-------- C:\Program Files\windows nt
2006-12-19 16:16 -------- d-------- C:\Program Files\msn gaming zone
2006-12-19 16:16 -------- d-------- C:\Program Files\messenger
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"NeroHomeFirstStart"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NMFirstStart.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"DU Meter"="C:\\Program Files\\DU Meter\\DUMeter.exe"
"Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"KAVPersonal50"=""C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus Personal Pro\\kav.exe" /minimize"
"SunJavaUpdateSched"=""C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe""
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"
"NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe"
"Samsung Common SM"=""C:\\WINDOWS\\Samsung\\ComSMMgr\\ssmmgr.exe" /autorun"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
"!AVG Anti-Spyware"=""C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe" /minimized"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{2C1CD3D7-86AC-4068-93BC-A02304B60787}"="DCOM Server 60787"
"{2C1CD3D7-86AC-4068-93BC-A02304B37389}"="DCOM Server 37389"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"=dword:00000000
"NoColorChoice"=dword:00000000
"NoSizeChoice"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
"NoDispScrSavPage"=dword:00000000
"NoDispCPL"=dword:00000000
"NoVisualStyleChoice"=dword:00000000
"NoDispSettingsPage"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktopChanges"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSaveSettings"=dword:00000000
"NoThemesTab"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
Shell\AutoRun\command D:\SETUP.EXE
Completion time: 07-02-01 12:19:35
C:\ComboFix2.txt ... 07-01-31 22:43
C:\ComboFix3.txt ... 07-01-31 21:10
Aqui napisał(a):Rootkit >>> zaznaczone Pokaż wszystko
przez Aqui 01 Lut 2007, 16:03
przez Wariat 01 Lut 2007, 16:14
przez wojtas 01 Lut 2007, 17:10
przez Red 01 Lut 2007, 17:35
Wariat napisał(a):a w normalnym nie zdąże bo zaraz po uruchomieniu zmuła, potem kasprzak wykrywa wira i reset
przez Wariat 01 Lut 2007, 19:26
wyłączyłem... i nie mogę nic ściągnąć... nawet strona nie chce się załadowaćRed napisał(a):wylacz kasprzaka
przez Wariat 01 Lut 2007, 20:17
syfka killboxe'em w trybie awaryjnymc:\windows\system32\wsys.dll
przez Wariat 01 Lut 2007, 21:34
"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
"zbznjvvc" = ""C:\DOCUME~1\KROKU\USTAWI~1\Temp\zbznjvvc.exe " " [file not found]
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"SpeedX" = "C:\SpeedX.exe" ["MyPortal.pl"]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"" ["Nero AG"]
"µTorrent" = ""C:\Program Files\uTorrent\uTorrent.exe"" [null data]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"DU Meter" = "C:\Program Files\DU Meter\DUMeter.exe" ["Hagel Technologies"]
"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]
"KAVPersonal50" = ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize" ["Kaspersky Lab"]
"SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data]
"NeroFilterCheck" = "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" ["Nero AG"]
"Samsung Common SM" = ""C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun" ["Samsung Electronics."]
"KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k"
"!AVG Anti-Spyware" = ""C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized" ["Anti-Malware Development a.s."]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Megaupload Toolbar"
\InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM...CLSID} = "RealOne Player Context Menu Class"
\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension"
-> {HKLM...CLSID} = "7-Zip Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"
-> {HKLM...CLSID} = "7-Zip Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"]
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."]
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll" ["Kaspersky Lab"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"
-> {HKLM...CLSID} = "7-Zip Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"]
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll" ["Kaspersky Lab"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------
Note: detected settings may not have any effect.
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\
"NoActiveDesktop" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Desktop|Desktop / Active Desktop|
Disable Active Desktop}
"ClassicShell" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Windows Explorer|
Enable Classic Shell / Turn on Classic Shell}
"ForceActiveDesktopOn" = (REG_DWORD) hex:0x00000001
{User Configuration|Administrative Templates|Desktop|Desktop / Active Desktop|
Enable Active Desktop}
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\
"NoActiveDesktopChanges" = (REG_DWORD) hex:0x00000000
{unrecognized setting}
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\
"DisableTaskMgr" = (REG_DWORD) hex:0x00000001
{User Configuration|Administrative Templates|System|Ctrl+Alt+Del Options|
Remove Task Manager}
"Wallpaper" = (REG_SZ) C:\WINDOWS\desktop.html
{User Configuration|Administrative Templates|Desktop|Desktop / Active Desktop|
Active Desktop Wallpaper|Wallpaper Name:}
"DisableRegistryTools" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|System|
Prevent access to registry editing tools}
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\
"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}
"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}
"DisableTaskMgr" = (REG_DWORD) hex:0x00000000
{unrecognized setting}
Active Desktop and Wallpaper:
-----------------------------
Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"
Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\KROKU\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"
Enabled Screen Saver:
---------------------
HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 14
%SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06
Toolbars, Explorer Bars, Extensions:
------------------------------------
Toolbars
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}"
-> {HKLM...CLSID} = "Megaupload Toolbar"
\InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"]
HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided)
-> {HKLM...CLSID} = "Megaupload Toolbar"
\InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"]
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.5.0_10"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_10"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll" ["Sun Microsystems, Inc."]
{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]
Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------
AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["Anti-Malware Development a.s."]
kavsvc, kavsvc, ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe"" ["Kaspersky Lab"]
Print Monitors:
---------------
HKLM\System\CurrentControlSet\Control\Print\Monitors\
SUGS2 Langmon\Driver = "SUGS2LMK.DLL" ["Samsung Electronics."]
----------
<<!>>: Suspicious data at a malware launch point.
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 320 seconds, including 4 seconds for message boxes)
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
+ Created at: 20:16 07-02-01
+ Scan result:
C:\Documents and Settings\KROKU\Ustawienia lokalne\Temp\maxdd1.game -> Dialer.GBDialer.i : Cleaned.
C:\Documents and Settings\KROKU\Ustawienia lokalne\Temp\6.dllb -> Downloader.Tibs.gc : Cleaned.
C:\Documents and Settings\KROKU\Ustawienia lokalne\Temp\7.dllb -> Downloader.Tibs.gc : Cleaned.
C:\Documents and Settings\KROKU\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G1YJYF4H\windin[1].exe -> Dropper.Small.avs : Cleaned.
:mozilla.40:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\f38tsmq8.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.41:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\f38tsmq8.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.42:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\f38tsmq8.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.43:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\f38tsmq8.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.59:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\f38tsmq8.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.60:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\f38tsmq8.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.80:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\f38tsmq8.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.81:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\f38tsmq8.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
C:\Documents and Settings\KROKU\Cookies\kroku@searchportal.information[1].txt -> TrackingCookie.Information : Cleaned.
:mozilla.62:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\f38tsmq8.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\KROKU\Cookies\kroku@realmedia[1].txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.75:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\f38tsmq8.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.76:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\f38tsmq8.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.36:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\f38tsmq8.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.37:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\f38tsmq8.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.38:C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\f38tsmq8.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\KROKU\Ustawienia lokalne\Temp\vx1t1.game -> Worm.Zhelatin.l : Cleaned.
::Report endLogfile of HijackThis v1.99.1
Scan saved at 20:18, on 07-02-01
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\SpeedX.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Konnekt\konnekt.exe
C:\Documents and Settings\KROKU\Pulpit\hijackthis_199\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Samsung Common SM] "C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [SpeedX] C:\SpeedX.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: IN - Sysinternals - www.sysinternals.com - C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\IN.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: WKLTSPV - Sysinternals - www.sysinternals.com - C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\WKLTSPV.exe
GMER 1.0.12.12011 - http://www.gmer.net
Autostart scan 2007-02-01 20:22:21
Windows 5.1.2600 Dodatek Service Pack 2
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager@BootExecute = autocheck autochk * /*file not found*/
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
HKLM\SYSTEM\CurrentControlSet\Control\WOW@cmdline = %SystemRoot%\system32\ntvdm.exe
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon >>>
@UserinitC:\WINDOWS\system32\userinit.exe, = C:\WINDOWS\system32\userinit.exe,
@ShellExplorer.exe = Explorer.exe
@System =
@UIHostlogonui.exe = logonui.exe
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ >>>
crypt32chain@DLLName = crypt32.dll
cryptnet@DLLName = cryptnet.dll
cscdll@DLLName = cscdll.dll
ScCertProp@DLLName = wlnotify.dll
Schedule@DLLName = wlnotify.dll
sclgntfy@DLLName = sclgntfy.dll
SensLogn@DLLName = WlNotify.dll
termsrv@DLLName = wlnotify.dll
wlballoon@DLLName = wlnotify.dll
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs =
HKLM\SYSTEM\CurrentControlSet\Services\ >>>
AudioSrv /*Windows Audio*/@ = %SystemRoot%\System32\svchost.exe -k netsvcs
AVG Anti-Spyware Guard /*AVG Anti-Spyware Guard*/@ = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
BITS /*Us*/@ = %SystemRoot%\system32\svchost.exe -k netsvcs
Browser /*Przegl*/@ = %SystemRoot%\system32\svchost.exe -k netsvcs
CryptSvc /*Us*/@ = %SystemRoot%\system32\svchost.exe -k netsvcs
DcomLaunch /*Program uruchamiaj*/@ = %SystemRoot%\system32\svchost -k DcomLaunch
Dhcp /*Klient DHCP*/@ = %SystemRoot%\system32\svchost.exe -k netsvcs
dmserver /*Mened*/@ = %SystemRoot%\System32\svchost.exe -k netsvcs
Dnscache /*Klient DNS*/@ = %SystemRoot%\system32\svchost.exe -k NetworkService
ERSvc /*Us*/@ = %SystemRoot%\System32\svchost.exe -k netsvcs
Eventlog /*Dziennik zdarze*/@ = %SystemRoot%\system32\services.exe
helpsvc /*Pomoc i obs*/@ = %SystemRoot%\System32\svchost.exe -k netsvcs
HidServ /*HID Input Service*/@ = %SystemRoot%\System32\svchost.exe -k netsvcs
Irmon /*Monitor podczerwieni*/@ = %SystemRoot%\system32\svchost.exe -k netsvcs
kavsvc /*kavsvc*/@ = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe"
lanmanserver /*Serwer*/@ = %SystemRoot%\system32\svchost.exe -k netsvcs
lanmanworkstation /*Stacja robocza*/@ = %SystemRoot%\system32\svchost.exe -k netsvcs
LmHosts /*Pomoc TCP/IP NetBIOS*/@ = %SystemRoot%\system32\svchost.exe -k LocalService
PlugPlay /*Plug and Play*/@ = %SystemRoot%\system32\services.exe
PolicyAgent /*Us*/@ = %SystemRoot%\system32\lsass.exe
ProtectedStorage /*Magazyn chroniony*/@ = %SystemRoot%\system32\lsass.exe
RemoteRegistry /*Rejestr zdalny*/@ = %SystemRoot%\system32\svchost.exe -k LocalService
RpcSs /*Zdalne wywo*/@ = %SystemRoot%\system32\svchost -k rpcss
SamSs /*Mened*/@ = %SystemRoot%\system32\lsass.exe
Schedule /*Harmonogram zada*/@ = %SystemRoot%\System32\svchost.exe -k netsvcs
seclogon /*Logowanie pomocnicze*/@ = %SystemRoot%\System32\svchost.exe -k netsvcs
SENS /*Zawiadomienie o zdarzeniu systemowym*/@ = %SystemRoot%\system32\svchost.exe -k netsvcs
ShellHWDetection /*Wykrywanie sprz*/@ = %SystemRoot%\System32\svchost.exe -k netsvcs
Spooler /*Bufor wydruku*/@ = %SystemRoot%\system32\spoolsv.exe
srservice /*Us*/@ = %SystemRoot%\system32\svchost.exe -k netsvcs
stisvc /*Windows Image Acquisition (WIA)*/@ = %SystemRoot%\system32\svchost.exe -k imgsvc
Themes /*Kompozycje*/@ = %SystemRoot%\System32\svchost.exe -k netsvcs
TrkWks /*Klient */@ = %SystemRoot%\system32\svchost.exe -k netsvcs
W32Time /*Us*/@ = %SystemRoot%\System32\svchost.exe -k netsvcs
WebClient /*WebClient*/@ = %SystemRoot%\system32\svchost.exe -k LocalService
winmgmt /*Instrumentacja zarz*/@ = %systemroot%\system32\svchost.exe -k netsvcs
wuauserv /*Aktualizacje automatyczne*/@ = %systemroot%\system32\svchost.exe -k netsvcs
WZCSVC /*Konfiguracja zerowej sieci bezprzewodowej*/@ = %SystemRoot%\System32\svchost.exe -k netsvcs
HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@DU MeterC:\Program Files\DU Meter\DUMeter.exe = C:\Program Files\DU Meter\DUMeter.exe
@CmaudioRunDll32 cmicnfg.cpl,CMICtrlWnd = RunDll32 cmicnfg.cpl,CMICtrlWnd
@KAVPersonal50"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize
@SunJavaUpdateSched"C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" = "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
@WinampAgentC:\Program Files\Winamp\winampa.exe = C:\Program Files\Winamp\winampa.exe
@NeroFilterCheckC:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe = C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
@Samsung Common SM"C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun = "C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun
@KernelFaultCheck%systemroot%\system32\dumprep 0 -k = %systemroot%\system32\dumprep 0 -k
@!AVG Anti-Spyware"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
HKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>
@SpeedXC:\SpeedX.exe = C:\SpeedX.exe
@BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" = "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
@?Torrent(null) =
@MSMSGS"C:\Program Files\Messenger\msmsgs.exe" /background = "C:\Program Files\Messenger\msmsgs.exe" /background
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run@zbznjvvc = "C:\DOCUME~1\KROKU\USTAWI~1\Temp\zbznjvvc.exe " /*file not found*/
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad >>>
@PostBootReminder%SystemRoot%\system32\SHELL32.dll = %SystemRoot%\system32\SHELL32.dll
@CDBurn%SystemRoot%\system32\SHELL32.dll = %SystemRoot%\system32\SHELL32.dll
@WebCheck%SystemRoot%\system32\webcheck.dll = %SystemRoot%\system32\webcheck.dll
@SysTrayC:\WINDOWS\system32\stobject.dll = C:\WINDOWS\system32\stobject.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler >>>
@{438755C2-A8BA-11D1-B96B-00A0C90312E1}%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{8C7461EF-2B13-11d2-BE35-3078302C2030}%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{2C1CD3D7-86AC-4068-93BC-A02304B60787}(null) =
@{2C1CD3D7-86AC-4068-93BC-A02304B37389}(null) =
HKLM\Software\Classes\Folder\shell\open\command@ = %SystemRoot%\Explorer.exe /idlist,%I,%L
HKLM\Software\Classes\Folder\shell\explore\command@ = %SystemRoot%\Explorer.exe /e,/idlist,%I,%L
HKLM\Software\Classes\ >>>
.exe@ = "%1" %*
.com@ = "%1" %*
.cmd@ = "%1" %*
.bat@ = "%1" %*
.pif@ = "%1" %*
.scr@ = "%1" /S
.hta@ = C:\WINDOWS\system32\mshta.exe "%1" %*
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks >>>
@{AEB6717E-7E19-11d0-97EE-00C04FD91972}shell32.dll = shell32.dll
@{57B86673-276A-48B2-BAE7-C6DBB3020EB8}C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{00022613-0000-0000-C000-000000000046} /*Karta w*/mmsys.cpl = mmsys.cpl
@{176d6597-26d3-11d1-b350-080036a75b03} /*Zarz*/icmui.dll = icmui.dll
@{1F2E5C40-9550-11CE-99D2-00AA006E086C} /*Strona zabezpiecze*/rshx32.dll = rshx32.dll
@{3EA48300-8CF6-101B-84FB-666CCB9BCD32} /*Strona w*/docprop.dll = docprop.dll
@{40dd6e20-7c17-11ce-a804-00aa003ca9f6} /*Rozszerzenia pow*/ntshrui.dll = ntshrui.dll
@{41E300E0-78B6-11ce-849B-444553540000} /*PlusPack CPL Extension*/%SystemRoot%\system32\themeui.dll = %SystemRoot%\system32\themeui.dll
@{42071712-76d4-11d1-8b24-00a0c9068ff3} /*Rozszerzenie CPL karty graficznej*/deskadp.dll = deskadp.dll
@{42071713-76d4-11d1-8b24-00a0c9068ff3} /*Rozszerzenie CPL monitora wy*/deskmon.dll = deskmon.dll
@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*Rozszerzenie CPL kadrowania wy*/deskpan.dll /*file not found*/ = deskpan.dll /*file not found*/
@{4E40F770-369C-11d0-8922-00A024AB2DBB} /*Strona zabezpiecze*/dssec.dll = dssec.dll
@{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8} /*Strona zgodno*/SlayerXP.dll = SlayerXP.dll
@{56117100-C0CD-101B-81E2-00AA004AE837} /*Program obs*/shscrap.dll = shscrap.dll
@{59099400-57FF-11CE-BD94-0020AF85B590} /*Rozszerzenie Disc Copy*/diskcopy.dll = diskcopy.dll
@{59be4990-f85c-11ce-aff7-00aa003ca9f6} /*Rozszerzenia pow*/ntlanui2.dll = ntlanui2.dll
@{5DB2625A-54DF-11D0-B6C4-0800091AA605} /*Zarz*/%SystemRoot%\System32\icmui.dll = %SystemRoot%\System32\icmui.dll
@{675F097E-4C4D-11D0-B6C1-0800091AA605} /*Zarz*/%SystemRoot%\system32\icmui.dll = %SystemRoot%\system32\icmui.dll
@{764BF0E1-F219-11ce-972D-00AA00A14F56} /*Rozszerzenia pow*/(null) =
@{77597368-7b15-11d0-a0c2-080036af3f03} /*Rozszerzenie pow*/printui.dll = printui.dll
@{7988B573-EC89-11cf-9C00-00AA00A14F56} /*Disk Quota UI*/dskquoui.dll = dskquoui.dll
@{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} /*Menu kontekstowe szyfrowania*/(null) =
@{85BBD920-42A0-1069-A2E4-08002B30309D} /*Aktówka*/syncui.dll = syncui.dll
@{88895560-9AA2-1069-930E-00AA0030EBC8} /*Rozszerzenie ikony HyperTerminalu*/C:\WINDOWS\system32\hticons.dll = C:\WINDOWS\system32\hticons.dll
@{BD84B380-8CA2-1069-AB1D-08000948F534} /*Fonts*/fontext.dll = fontext.dll
@{DBCE2480-C732-101B-BE72-BA78E9AD5B27} /*Profil ICC*/%SystemRoot%\system32\icmui.dll = %SystemRoot%\system32\icmui.dll
@{F37C5810-4D3F-11d0-B4BF-00AA00BBB723} /*Strona zabezpiecze*/rshx32.dll = rshx32.dll
@{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} /*Rozszerzenia pow*/ntshrui.dll = ntshrui.dll
@{f92e8c40-3d33-11d2-b1aa-080036a75b03} /*Display TroubleShoot CPL Extension*/deskperf.dll = deskperf.dll
@{7444C717-39BF-11D1-8CD9-00C04FC29D45} /*Rozszerzenie Crypto PKO*/C:\WINDOWS\system32\cryptext.dll = C:\WINDOWS\system32\cryptext.dll
@{7444C719-39BF-11D1-8CD9-00C04FC29D45} /*Rozszerzenie Crypto Sign*/C:\WINDOWS\system32\cryptext.dll = C:\WINDOWS\system32\cryptext.dll
@{7007ACC7-3202-11D1-AAD2-00805FC1270E} /*Po*/C:\WINDOWS\system32\NETSHELL.dll = C:\WINDOWS\system32\NETSHELL.dll
@{992CFFA0-F557-101A-88EC-00DD010CCC48} /*Po*/C:\WINDOWS\system32\NETSHELL.dll = C:\WINDOWS\system32\NETSHELL.dll
@{E211B736-43FD-11D1-9EFB-0000F8757FCD} /*&Skanery i aparaty fotograficzne*/wiashext.dll = wiashext.dll
@{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD} /*&Skanery i aparaty fotograficzne*/wiashext.dll = wiashext.dll
@{905667aa-acd6-11d2-8080-00805f6596d2} /*&Skanery i aparaty fotograficzne*/wiashext.dll = wiashext.dll
@{3F953603-1008-4f6e-A73A-04AAC7A992F1} /*&Skanery i aparaty fotograficzne*/wiashext.dll = wiashext.dll
@{83bbcbf3-b28a-4919-a5aa-73027445d672} /*&Skanery i aparaty fotograficzne*/wiashext.dll = wiashext.dll
@{F0152790-D56E-4445-850E-4F3117DB740C} /*Remote Sessions CPL Extension*/C:\WINDOWS\system32\remotepg.dll = C:\WINDOWS\system32\remotepg.dll
@{60254CA5-953B-11CF-8C96-00AA00B8708C} /*Rozszerzenia pow*/C:\WINDOWS\system32\wshext.dll = C:\WINDOWS\system32\wshext.dll
@{2206CDB2-19C1-11D1-89E0-00C04FD7A829} /*Microsoft Data Link*/C:\Program Files\Common Files\System\Ole DB\oledb32.dll = C:\Program Files\Common Files\System\Ole DB\oledb32.dll
@{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF} /*Tasks Folder Icon Handler*/C:\WINDOWS\system32\mstask.dll = C:\WINDOWS\system32\mstask.dll
@{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF} /*Tasks Folder Shell Extension*/C:\WINDOWS\system32\mstask.dll = C:\WINDOWS\system32\mstask.dll
@{D6277990-4C6A-11CF-8D87-00AA0060F5BF} /*Zaplanowane zadania*/C:\WINDOWS\system32\mstask.dll = C:\WINDOWS\system32\mstask.dll
@{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0} /*Set Program Access and Defaults*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{5F327514-6C5E-4d60-8F16-D07FA08A78ED} /*Auto Update Property Sheet Extension*/C:\WINDOWS\system32\wuaucpl.cpl = C:\WINDOWS\system32\wuaucpl.cpl
@{0DF44EAA-FF21-4412-828E-260A8728E7F1} /*Pasek zada*/(null) =
@{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0} /*Wyszukaj*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0} /*Pomoc i obs*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0} /*Pomoc i obs*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0} /*Uruchom...*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0} /*Internet*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0} /*E-mail*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{D20EA4E1-3957-11d2-A40B-0C5020524152} /*Czcionki*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{D20EA4E1-3957-11d2-A40B-0C5020524153} /*Narz*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{596AB062-B4D2-4215-9F74-E9109B0A8153} /*Strona w*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll
@{9DB7A13C-F208-4981-8353-73CC61AE2783} /*Poprzednie wersje*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll
@{875CB1A1-0F29-45de-A1AE-CFB4950D0B78} /*Audio Media Properties Handler*/%SystemRoot%\system32\shmedia.dll = %SystemRoot%\system32\shmedia.dll
@{40C3D757-D6E4-4b49-BB41-0E5BBEA28817} /*Video Media Properties Handler*/%SystemRoot%\system32\shmedia.dll = %SystemRoot%\system32\shmedia.dll
@{E4B29F9D-D390-480b-92FD-7DDB47101D71} /*Wav Properties Handler*/%SystemRoot%\system32\shmedia.dll = %SystemRoot%\system32\shmedia.dll
@{87D62D94-71B3-4b9a-9489-5FE6850DC73E} /*Avi Properties Handler*/%SystemRoot%\system32\shmedia.dll = %SystemRoot%\system32\shmedia.dll
@{A6FD9E45-6E44-43f9-8644-08598F5A74D9} /*Midi Properties Handler*/%SystemRoot%\system32\shmedia.dll = %SystemRoot%\system32\shmedia.dll
@{c5a40261-cd64-4ccf-84cb-c394da41d590} /*Video Thumbnail Extractor*/%SystemRoot%\system32\shmedia.dll = %SystemRoot%\system32\shmedia.dll
@{5E6AB780-7743-11CF-A12B-00AA004AE837} /*Pasek narz*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{22BF0C20-6DA7-11D0-B373-00A0C9034938} /*Stan pobierania*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{91EA3F8B-C99B-11d0-9815-00C04FD91972} /*Folder pow*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{6413BA2C-B461-11d1-A18A-080036B11A03} /*Folder pow*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{F61FFEC1-754F-11d0-80CA-00AA005B4383} /*BandProxy*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{7BA4C742-9E81-11CF-99D3-00AA004AE837} /*Pasek przegl*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{30D02401-6A81-11d0-8274-00C04FD5AE38} /*Pasek wyszukiwania*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{169A0691-8DF9-11d1-A1C4-00C04FD75D13} /*Wyszukiwanie w okienku*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{07798131-AF23-11d1-9111-00A0C98BA67D} /*Wyszukiwanie w sieci Web*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{AF4F6510-F982-11d0-8595-00AA004CD6D8} /*Narz*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{01E04581-4EEE-11d0-BFE9-00AA005B4383} /*&Adres*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{A08C11D2-A228-11d0-825B-00AA005B4383} /*Pole edycji adresu*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{00BB2763-6A77-11D0-A535-00C04FD7D062} /*Autouzupe*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{7376D660-C583-11d0-A3A5-00C04FD706EC} /*Wyodr*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{6756A641-DE71-11d0-831B-00AA005B4383} /*Lista autouzupe*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A} /*Niestandardowa lista autouzupe*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{7e653215-fa25-46bd-a339-34a2790f3cb7} /*Dost*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{acf35015-526e-4230-9596-becbe19f0ac9} /*Pasek podr*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{00BB2764-6A77-11D0-A535-00C04FD7D062} /*Lista autouzupe*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{03C036F1-A186-11D0-824A-00AA005B4383} /*Lista autouzupe*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{00BB2765-6A77-11D0-A535-00C04FD7D062} /*Kontener wielu list autouzupe*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{ECD4FC4E-521C-11D0-B792-00A0C90312E1} /*Menu witryny paska pow*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{3CCF8A41-5C85-11d0-9796-00AA00B90ADF} /*Shell DeskBarApp*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{ECD4FC4C-521C-11D0-B792-00A0C90312E1} /*Pasek pulpitu pow*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{ECD4FC4D-521C-11D0-B792-00A0C90312E1} /*Shell Rebar BandSite*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{DD313E04-FEFF-11d1-8ECD-0000F87A470C} /*Pomoc dla u*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11} /*Globalne ustawienia folderów*/%SystemRoot%\system32\browseui.dll = %SystemRoot%\system32\browseui.dll
@{EFA24E61-B078-11d0-89E4-00C04FC9E26E} /*Favorites Band*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{0A89A860-D7B1-11CE-8350-444553540000} /*Shell Automation Inproc Service*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} /*Shell DocObject Viewer*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{A5E46E3A-8849-11D1-9D8C-00C04FC99D61} /*Microsoft Browser Architecture*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{FBF23B40-E3F0-101B-8488-00AA003E56F8} /*InternetShortcut*/shdocvw.dll = shdocvw.dll
@{3C374A40-BAE4-11CF-BF7D-00AA006946EE} /*Microsoft Url History Service*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{FF393560-C2A7-11CF-BFF4-444553540000} /*Historia*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{7BD29E00-76C1-11CF-9DD0-00A0C9034933} /*Tymczasowe pliki internetowe*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{7BD29E01-76C1-11CF-9DD0-00A0C9034933} /*Tymczasowe pliki internetowe*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{CFBFAE00-17A6-11D0-99CB-00C04FD64497} /*Microsoft Url Search Hook*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC} /*Ekran powitalny pakietu IE4*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{67EA19A0-CCEF-11d0-8024-00C04FD75D13} /*CDF Extension Copy Hook*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{131A6951-7F78-11D0-A979-00C04FD705A2} /*ISFBand OC*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{9461b922-3c5a-11d2-bf8b-00c04fb93661} /*Search Assistant OC*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{3DC7A020-0ACD-11CF-A9BB-00AA004AE837} /*Internet*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{871C5380-42A0-1069-A2EA-08002B30309D} /*Internet Name Space*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{EFA24E64-B078-11d0-89E4-00C04FC9E26E} /*Pasek eksploratora*/%SystemRoot%\system32\shdocvw.dll = %SystemRoot%\system32\shdocvw.dll
@{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE} /*Sendmail service*/C:\WINDOWS\system32\sendmail.dll = C:\WINDOWS\system32\sendmail.dll
@{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE} /*Sendmail service*/C:\WINDOWS\system32\sendmail.dll = C:\WINDOWS\system32\sendmail.dll
@{88C6C381-2E85-11D0-94DE-444553540000} /*Folder pami*/%SystemRoot%\system32\occache.dll = %SystemRoot%\system32\occache.dll
@{E6FB5E20-DE35-11CF-9C87-00AA005127ED} /*WebCheck*/%SystemRoot%\system32\webcheck.dll = %SystemRoot%\system32\webcheck.dll
@{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE} /*Subscription Mgr*/%SystemRoot%\system32\webcheck.dll = %SystemRoot%\system32\webcheck.dll
@{F5175861-2688-11d0-9C5E-00AA00A45957} /*Folder subskrypcji*/%SystemRoot%\system32\webcheck.dll = %SystemRoot%\system32\webcheck.dll
@{08165EA0-E946-11CF-9C87-00AA005127ED} /*WebCheckWebCrawler*/%SystemRoot%\system32\webcheck.dll = %SystemRoot%\system32\webcheck.dll
@{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB} /*WebCheckChannelAgent*/%SystemRoot%\system32\webcheck.dll = %SystemRoot%\system32\webcheck.dll
@{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7} /*TrayAgent*/%SystemRoot%\system32\webcheck.dll = %SystemRoot%\system32\webcheck.dll
@{7D559C10-9FE9-11d0-93F7-00AA0059CE02} /*Code Download Agent*/%SystemRoot%\system32\webcheck.dll = %SystemRoot%\system32\webcheck.dll
@{E6CC6978-6B6E-11D0-BECA-00C04FD940BE} /*ConnectionAgent*/%SystemRoot%\system32\webcheck.dll = %SystemRoot%\system32\webcheck.dll
@{D8BD2030-6FC9-11D0-864F-00AA006809D9} /*PostAgent*/%SystemRoot%\system32\webcheck.dll = %SystemRoot%\system32\webcheck.dll
@{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB} /*WebCheck SyncMgr Handler*/%SystemRoot%\system32\webcheck.dll = %SystemRoot%\system32\webcheck.dll
@{352EC2B7-8B9A-11D1-B8AE-006008059382} /*Mened*/%SystemRoot%\system32\appwiz.cpl = %SystemRoot%\system32\appwiz.cpl
@{0B124F8F-91F0-11D1-B8B5-006008059382} /*Wyliczanie zainstalowanych aplikacji*/%SystemRoot%\system32\appwiz.cpl = %SystemRoot%\system32\appwiz.cpl
@{CFCCC7A0-A282-11D1-9082-006008059382} /*Publikator aplikacji Darwin*/%SystemRoot%\system32\appwiz.cpl = %SystemRoot%\system32\appwiz.cpl
@{e84fda7c-1d6a-45f6-b725-cb260c236066} /*Shell Image Verbs*/%SystemRoot%\system32\shimgvw.dll = %SystemRoot%\system32\shimgvw.dll
@{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178} /*Shell Image Data Factory*/%SystemRoot%\system32\shimgvw.dll = %SystemRoot%\system32\shimgvw.dll
@{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} /*Autoplay for SlideShow*/(null) =
@{3F30C968-480A-4C6C-862D-EFC0897BB84B} /*GDI+program wyodr*/C:\WINDOWS\system32\shimgvw.dll = C:\WINDOWS\system32\shimgvw.dll
@{9DBD2C50-62AD-11d0-B806-00C04FD706EC} /*Informacje podsumowuj*/C:\WINDOWS\system32\shimgvw.dll = C:\WINDOWS\system32\shimgvw.dll
@{EAB841A0-9550-11cf-8C16-00805F1408F3} /*Wyodr*/C:\WINDOWS\system32\shimgvw.dll = C:\WINDOWS\system32\shimgvw.dll
@{eb9b1153-3b57-4e68-959a-a3266bc3d7fe} /*Shell Image Property Handler*/%SystemRoot%\system32\shimgvw.dll = %SystemRoot%\system32\shimgvw.dll
@{CC6EEFFB-43F6-46c5-9619-51D571967F7D} /*Kreator publikacji w sieci Web*/%SystemRoot%\system32\netplwiz.dll = %SystemRoot%\system32\netplwiz.dll
@{add36aa8-751a-4579-a266-d66f5202ccbb} /*Zamawianie odbitek w sieci Web*/%SystemRoot%\system32\netplwiz.dll = %SystemRoot%\system32\netplwiz.dll
@{6b33163c-76a5-4b6c-bf21-45de9cd503a1} /*Obiekt pow*/%SystemRoot%\system32\netplwiz.dll = %SystemRoot%\system32\netplwiz.dll
@{58f1f272-9240-4f51-b6d4-fd63d1618591} /*Kreator uzyskiwania profilu us*/%SystemRoot%\system32\netplwiz.dll = %SystemRoot%\system32\netplwiz.dll
@{7A9D77BD-5403-11d2-8785-2E0420524153} /*Konta u*/(null) =
@{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31} /*Folder skompresowany (zip)*/%SystemRoot%\system32\zipfldr.dll = %SystemRoot%\system32\zipfldr.dll
@{BD472F60-27FA-11cf-B8B4-444553540000} /*Compressed (zipped) Folder Right Drag Handler*/%SystemRoot%\system32\zipfldr.dll = %SystemRoot%\system32\zipfldr.dll
@{888DCA60-FC0A-11CF-8F0F-00C04FD7D062} /*Compressed (zipped) Folder SendTo Target*/%SystemRoot%\system32\zipfldr.dll = %SystemRoot%\system32\zipfldr.dll
@{f39a0dc0-9cc8-11d0-a599-00c04fd64433} /*Plik kana*/%SystemRoot%\system32\cdfview.dll = %SystemRoot%\system32\cdfview.dll
@{f3aa0dc0-9cc8-11d0-a599-00c04fd64434} /*Skrót kana*/%SystemRoot%\system32\cdfview.dll = %SystemRoot%\system32\cdfview.dll
@{f3ba0dc0-9cc8-11d0-a599-00c04fd64435} /*Obiekt obs*/%SystemRoot%\system32\cdfview.dll = %SystemRoot%\system32\cdfview.dll
@{f3da0dc0-9cc8-11d0-a599-00c04fd64437} /*Channel Menu*/%SystemRoot%\system32\cdfview.dll = %SystemRoot%\system32\cdfview.dll
@{f3ea0dc0-9cc8-11d0-a599-00c04fd64438} /*Channel Properties*/%SystemRoot%\system32\cdfview.dll = %SystemRoot%\system32\cdfview.dll
@{692F0339-CBAA-47e6-B5B5-3B84DB604E87} /*Extensions Manager Folder*/%SystemRoot%\system32\extmgr.dll = %SystemRoot%\system32\extmgr.dll
@{63da6ec0-2e98-11cf-8d82-444553540000} /*FTP Folders Webview*/C:\WINDOWS\system32\msieftp.dll = C:\WINDOWS\system32\msieftp.dll
@{883373C3-BF89-11D1-BE35-080036B11A03} /*Microsoft DocProp Shell Ext*/C:\WINDOWS\system32\docprop2.dll = C:\WINDOWS\system32\docprop2.dll
@{A9CF0EAE-901A-4739-A481-E35B73E47F6D} /*Microsoft DocProp Inplace Edit Box Control*/C:\WINDOWS\system32\docprop2.dll = C:\WINDOWS\system32\docprop2.dll
@{8EE97210-FD1F-4B19-91DA-67914005F020} /*Microsoft DocProp Inplace ML Edit Box Control*/C:\WINDOWS\system32\docprop2.dll = C:\WINDOWS\system32\docprop2.dll
@{0EEA25CC-4362-4A12-850B-86EE61B0D3EB} /*Microsoft DocProp Inplace Droplist Combo Control*/C:\WINDOWS\system32\docprop2.dll = C:\WINDOWS\system32\docprop2.dll
@{6A205B57-2567-4A2C-B881-F787FAB579A3} /*Microsoft DocProp Inplace Calendar Control*/C:\WINDOWS\system32\docprop2.dll = C:\WINDOWS\system32\docprop2.dll
@{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33} /*Microsoft DocProp Inplace Time Control*/C:\WINDOWS\system32\docprop2.dll = C:\WINDOWS\system32\docprop2.dll
@{8A23E65E-31C2-11d0-891C-00A024AB2DBB} /*Directory Query UI*/%SystemRoot%\system32\dsquery.dll = %SystemRoot%\system32\dsquery.dll
@{9E51E0D0-6E0F-11d2-9601-00C04FA31A86} /*Shell properties for a DS object*/%SystemRoot%\system32\dsquery.dll = %SystemRoot%\system32\dsquery.dll
@{163FDC20-2ABC-11d0-88F0-00A024AB2DBB} /*Directory Object Find*/%SystemRoot%\system32\dsquery.dll = %SystemRoot%\system32\dsquery.dll
@{F020E586-5264-11d1-A532-0000F8757D7E} /*Directory Start/Search Find*/%SystemRoot%\system32\dsquery.dll = %SystemRoot%\system32\dsquery.dll
@{0D45D530-764B-11d0-A1CA-00AA00C16E65} /*Directory Property UI*/%SystemRoot%\system32\dsuiext.dll = %SystemRoot%\system32\dsuiext.dll
@{62AE1F9A-126A-11D0-A14B-0800361B1103} /*Directory Context Menu Verbs*/%SystemRoot%\system32\dsuiext.dll = %SystemRoot%\system32\dsuiext.dll
@{ECF03A33-103D-11d2-854D-006008059367} /*MyDocs Copy Hook*/%SystemRoot%\system32\mydocs.dll = %SystemRoot%\system32\mydocs.dll
@{ECF03A32-103D-11d2-854D-006008059367} /*MyDocs Drop Target*/%SystemRoot%\system32\mydocs.dll = %SystemRoot%\system32\mydocs.dll
@{4a7ded0a-ad25-11d0-98a8-0800361b1103} /*MyDocs Properties*/%SystemRoot%\system32\mydocs.dll = %SystemRoot%\system32\mydocs.dll
@{750fdf0e-2a26-11d1-a3ea-080036587f03} /*Offline Files Menu*/%SystemRoot%\System32\cscui.dll = %SystemRoot%\System32\cscui.dll
@{10CFC467-4392-11d2-8DB4-00C04FA31A66} /*Offline Files Folder Options*/%SystemRoot%\System32\cscui.dll = %SystemRoot%\System32\cscui.dll
@{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E} /*Folder plików trybu offline*/%SystemRoot%\System32\cscui.dll = %SystemRoot%\System32\cscui.dll
@{143A62C8-C33B-11D1-84FE-00C04FA34A14} /*Microsoft Agent Character Property Sheet Handler*/C:\WINDOWS\msagent\agentpsh.dll = C:\WINDOWS\msagent\agentpsh.dll
@{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6} /*DfsShell*/C:\WINDOWS\system32\dfsshlex.dll = C:\WINDOWS\system32\dfsshlex.dll
@{60fd46de-f830-4894-a628-6fa81bc0190d} /*%DESC_PublishDropTarget%*/%SystemRoot%\system32\photowiz.dll = %SystemRoot%\system32\photowiz.dll
@{7A80E4A8-8005-11D2-BCF8-00C04F72C717} /*MMC Icon Handler*/%SystemRoot%\System32\mmcshext.dll = %SystemRoot%\System32\mmcshext.dll
@{0CD7A5C0-9F37-11CE-AE65-08002B2E1262} /*.CAB file viewer*/cabview.dll = cabview.dll
@{32714800-2E5F-11d0-8B85-00AA0044F941} /*&Do osób...*/C:\Program Files\Outlook Express\wabfind.dll = C:\Program Files\Outlook Express\wabfind.dll
@{8DD448E6-C188-4aed-AF92-44956194EB1F} /*Windows Media Player Play as Playlist Context Menu Handler*/C:\WINDOWS\system32\wmpshell.dll = C:\WINDOWS\system32\wmpshell.dll
@{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C} /*Windows Media Player Burn Audio CD Context Menu Handler*/C:\WINDOWS\system32\wmpshell.dll = C:\WINDOWS\system32\wmpshell.dll
@{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD} /*Windows Media Player Add to Playlist Context Menu Handler*/C:\WINDOWS\system32\wmpshell.dll = C:\WINDOWS\system32\wmpshell.dll
@{B41DB860-8EE4-11D2-9906-E49FADC173CA} /*WinRAR shell extension*/C:\Program Files\WinRAR\rarext.dll = C:\Program Files\WinRAR\rarext.dll
@{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} /*Shell Extensions for RealOne Player*/C:\Program Files\Real\RealPlayer\rpshell.dll = C:\Program Files\Real\RealPlayer\rpshell.dll
@{23170F69-40C1-278A-1000-000100020000} /*7-Zip Shell Extension*/C:\Program Files\7-Zip\7-zip.dll = C:\Program Files\7-Zip\7-zip.dll
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>
7-Zip@{23170F69-40C1-278A-1000-000100020000} = C:\Program Files\7-Zip\7-zip.dll
AVG Anti-Spyware@{8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll
Kaspersky Anti-Virus@{dd230880-495a-11d1-b064-008048ec2fc5} = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll
Offline Files@{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
Open With@{09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll
Open With EncryptionMenu@{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll
HKLM\Software\Classes\*\shellex\ContextMenuHandlers >>>
@{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}%SystemRoot%\system32\SHELL32.dll = %SystemRoot%\system32\SHELL32.dll
@{EB4D3CFE-E2AA-4C6E-B2FE-2A749F95D208}C:\Program Files\Nero\Nero 7\Nero BackItUp\NBShell.dll = C:\Program Files\Nero\Nero 7\Nero BackItUp\NBShell.dll
HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ >>>
7-Zip@{23170F69-40C1-278A-1000-000100020000} = C:\Program Files\7-Zip\7-zip.dll
AVG Anti-Spyware@{8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll
EncryptionMenu@{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
Offline Files@{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
Sharing@{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ >>>
Kaspersky Anti-Virus@{dd230880-495a-11d1-b064-008048ec2fc5} = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers@{EB4D3CFE-E2AA-4C6E-B2FE-2A749F95D208} = C:\Program Files\Nero\Nero 7\Nero BackItUp\NBShell.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>>
@{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL = C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
@{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll = C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
HKCU\Control Panel\Desktop@SCRNSAVE.EXE = C:\WINDOWS\System32\logon.scr
HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
@Start Pageabout:blank = about:blank
@Local PageC:\windows\system32\blank.htm = C:\windows\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Start Pagehttp://www.onet.pl/ = http://www.onet.pl/
@Local PageC:\WINDOWS\system32\blank.htm = C:\WINDOWS\system32\blank.htm
HKLM\Software\Classes\PROTOCOLS\Filter\ >>>
Class Install Handler@CLSID = C:\WINDOWS\system32\urlmon.dll
deflate@CLSID = C:\WINDOWS\system32\urlmon.dll
gzip@CLSID = C:\WINDOWS\system32\urlmon.dll
lzdhtml@CLSID = C:\WINDOWS\system32\urlmon.dll
text/webviewhtml@CLSID = %SystemRoot%\system32\SHELL32.dll
HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
about@CLSID = %SystemRoot%\system32\mshtml.dll
cdl@CLSID = C:\WINDOWS\system32\urlmon.dll
dvd@CLSID = C:\WINDOWS\system32\msvidctl.dll
file@CLSID = C:\WINDOWS\system32\urlmon.dll
ftp@CLSID = C:\WINDOWS\system32\urlmon.dll
gopher@CLSID = C:\WINDOWS\system32\urlmon.dll
http@CLSID = C:\WINDOWS\system32\urlmon.dll
https@CLSID = C:\WINDOWS\system32\urlmon.dll
its@CLSID = C:\WINDOWS\system32\itss.dll
javascript@CLSID = %SystemRoot%\system32\mshtml.dll
local@CLSID = C:\WINDOWS\system32\urlmon.dll
mailto@CLSID = %SystemRoot%\system32\mshtml.dll
mhtml@CLSID = %SystemRoot%\system32\inetcomm.dll
mk@CLSID = C:\WINDOWS\system32\urlmon.dll
ms-its@CLSID = C:\WINDOWS\system32\itss.dll
res@CLSID = %SystemRoot%\system32\mshtml.dll
skype4com@CLSID = C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
sysimage@CLSID = %SystemRoot%\system32\mshtml.dll
tv@CLSID = C:\WINDOWS\system32\msvidctl.dll
vbscript@CLSID = %SystemRoot%\system32\mshtml.dll
wia@CLSID = C:\WINDOWS\system32\wiascr.dll
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters@Domain =
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ >>>
000000000001@LibraryPath = %SystemRoot%\System32\mswsock.dll
000000000002@LibraryPath = %SystemRoot%\System32\winrnr.dll
000000000003@LibraryPath = %SystemRoot%\System32\mswsock.dll
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ >>>
000000000001@PackedCatalogItem = %SystemRoot%\system32\mswsock.dll
000000000002@PackedCatalogItem = %SystemRoot%\system32\mswsock.dll
000000000003@PackedCatalogItem = %SystemRoot%\system32\mswsock.dll
000000000004@PackedCatalogItem = %SystemRoot%\system32\mswsock.dll
000000000005@PackedCatalogItem = %SystemRoot%\system32\rsvpsp.dll
000000000006@PackedCatalogItem = %SystemRoot%\system32\rsvpsp.dll
000000000007@PackedCatalogItem = %SystemRoot%\system32\mswsock.dll
000000000008@PackedCatalogItem = %SystemRoot%\system32\mswsock.dll
000000000009@PackedCatalogItem = %SystemRoot%\system32\mswsock.dll
000000000010@PackedCatalogItem = %SystemRoot%\system32\mswsock.dll
000000000011@PackedCatalogItem = %SystemRoot%\system32\mswsock.dll
000000000012@PackedCatalogItem = %SystemRoot%\system32\mswsock.dll
000000000013@PackedCatalogItem = %SystemRoot%\system32\mswsock.dll
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014@PackedCatalogItem = %SystemRoot%\system32\mswsock.dll
---- EOF - GMER 1.0.12 ----
przez Aqui 01 Lut 2007, 21:51
przez Wariat 01 Lut 2007, 21:52
właśnie widzeAqui napisał(a):przekroczyles mozliwa wielkosc posta...
"KROKU" - 07-02-01 19:56:15 Dodatek Service Pack 2
ComboFix 07.01.31 - Running from: "C:\Documents and Settings\Administrator\Pulpit"
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\DOCUME~1\KROKU\Dane aplikacji\Install.dat
((((((((((((((((((((((((((((((( Files Created from 2007-01-01 to 2007-02-01 ))))))))))))))))))))))))))))))))))
2007-02-01 18:38 <DIR> d-------- C:\!KillBox
2007-02-01 18:05 34,176 --a------ C:\WINDOWS\system32\main.sys
2007-02-01 11:54 80 --a------ C:\WINDOWS\gmer_uninstall.cmd
2007-01-31 23:11 <DIR> d-------- C:\avenger
2007-01-31 20:55 <DIR> d-------- C:\WINDOWS\Content.IE5
2007-01-31 19:25 1,930 --a------ C:\WINDOWS\system32\tmp.reg
2007-01-31 19:24 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe
2007-01-31 19:24 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-01-31 19:24 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-01-31 19:24 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2007-01-31 19:24 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-01-31 19:24 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2007-01-31 18:23 60,416 --a------ C:\WINDOWS\system32\drivers\ghnum^vh.sys
2007-01-30 22:11 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-01-30 22:11 <DIR> d-------- C:\Program Files\Grisoft
2007-01-30 22:00 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\stamina
2007-01-30 18:58 2,816 --a------ C:\WINDOWS\system32\reg.sys
2007-01-28 20:04 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-01-28 20:04 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start
2007-01-28 20:04 <DIR> d--hs---- C:\WINDOWS\CSC
2007-01-28 20:04 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-01-28 20:04 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony
2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione
2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit
2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-01-27 15:57 <DIR> d-------- C:\Program Files\DFX
2007-01-27 15:56 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-01-25 15:45 <DIR> d-------- C:\Program Files\uTorrent
2007-01-25 15:45 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\uTorrent
2007-01-20 21:17 <DIR> d-------- C:\Program Files\eMule
2007-01-19 09:19 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2007-01-19 09:19 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2007-01-19 09:19 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-01-13 17:48 <DIR> d-------- C:\Program Files\MegauploadToolbar
2007-01-13 17:48 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\MegauploadToolbar
2007-01-10 16:48 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\DivX
2007-01-10 16:39 <DIR> d-------- C:\Program Files\StrongDC++
2007-01-09 19:57 <DIR> d-------- C:\Program Files\Samsung ML-2010 Series
2007-01-09 19:55 57,344 --a------ C:\WINDOWS\system32\SSCoInst.dll
2007-01-09 19:55 41,984 --------- C:\WINDOWS\system32\drivers\DGIVECP.SYS
2007-01-09 19:55 208,896 --------- C:\WINDOWS\system32\SSRemove.exe
2007-01-09 19:55 20,622 --a------ C:\WINDOWS\system32\SUGS2LMK.DLL
2007-01-09 19:55 151,552 --a------ C:\WINDOWS\system32\SSCoInst.exe
2007-01-09 19:55 <DIR> d-------- C:\WINDOWS\Samsung
2007-01-09 19:54 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-01-09 19:22 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
2007-01-09 18:44 <DIR> d-------- C:\Program Files\7-Zip
2007-01-09 18:12 <DIR> d-------- C:\Program Files\IrfanView
2007-01-08 23:53 <DIR> d-------- C:\Program Files\Switch Off
2007-01-07 23:47 <DIR> d-------- C:\Program Files\Ontrack
2007-01-03 00:23 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-01-03 00:22 <DIR> d-------- C:\Program Files\Real
2007-01-03 00:22 <DIR> d-------- C:\Program Files\Common Files\Real
2007-01-03 00:21 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\Real
2007-01-03 00:18 <DIR> d-------- C:\My Downloads
2007-01-03 00:15 <DIR> d-------- C:\Program Files\Super Internet TV
2007-01-03 00:05 <DIR> d-------- C:\Program Files\Fma
2007-01-03 00:05 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\FMA
2007-01-02 23:52 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\Ahead
2007-01-02 23:49 <DIR> d-------- C:\Program Files\Nero
2007-01-02 23:49 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-01-02 23:49 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Dane aplikacji\Nero
2007-01-02 22:44 32,782 -ra------ C:\WINDOWS\system32\drivers\ser120.sys
2007-01-02 22:34 <DIR> d-------- C:\Program Files\Usb to Serial Driver 1.12.25
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-02-01 19:02 -------- d-------- C:\Program Files\mozilla firefox
2007-02-01 18:40 510976 --a------ C:\WINDOWS\system32\winlogon.exe
2007-01-30 18:57 -------- d---s---- C:\DOCUME~1\KROKU\Dane aplikacji\microsoft
2007-01-15 21:18 -------- d-------- C:\DOCUME~1\KROKU\Dane aplikacji\skype
2007-01-09 19:57 -------- d--h----- C:\Program Files\installshield installation information
2007-01-09 19:57 -------- d-------- C:\Program Files\Common Files\installshield
2007-01-09 18:54 -------- d-------- C:\Program Files\subedit-player
2007-01-03 00:22 -------- d-------- C:\Program Files\google
2006-12-31 10:21 -------- d-------- C:\Program Files\tonegen
2006-12-30 22:40 -------- d-------- C:\Program Files\skype
2006-12-30 22:40 -------- d-------- C:\Program Files\Common Files\skype
2006-12-29 22:17 -------- d-------- C:\DOCUME~1\KROKU\Dane aplikacji\mozilla
2006-12-22 16:35 -------- d-------- C:\Program Files\winamp
2006-12-21 01:17 -------- d-------- C:\DOCUME~1\KROKU\Dane aplikacji\google
2006-12-20 21:49 -------- d-------- C:\DOCUME~1\KROKU\Dane aplikacji\sun
2006-12-20 21:48 -------- d-------- C:\Program Files\java
2006-12-20 21:44 -------- d-------- C:\Program Files\Common Files\java
2006-12-19 19:02 -------- d-------- C:\Program Files\kaspersky lab
2006-12-19 18:59 -------- d-------- C:\DOCUME~1\KROKU\Dane aplikacji\macromedia
2006-12-19 17:10 -------- d-------- C:\Program Files\c-media 3d audio
2006-12-19 17:08 -------- d-------- C:\Program Files\Common Files\speechengines
2006-12-19 17:08 -------- d-------- C:\Program Files\Common Files\odbc
2006-12-19 17:07 62 --ahs---- C:\DOCUME~1\KROKU\Dane aplikacji\desktop.ini
2006-12-19 16:52 -------- d-------- C:\Program Files\konnekt
2006-12-19 16:27 -------- d-------- C:\DOCUME~1\KROKU\Dane aplikacji\identities
2006-12-19 16:22 -------- d-------- C:\Program Files\microsoft frontpage
2006-12-19 16:21 0 -rahs---- C:\MSDOS.SYS
2006-12-19 16:21 0 -rahs---- C:\IO.SYS
2006-12-19 16:21 0 --a------ C:\CONFIG.SYS
2006-12-19 16:21 0 --a------ C:\AUTOEXEC.BAT
2006-12-19 16:19 -------- d--h----- C:\Program Files\windowsupdate
2006-12-19 16:19 -------- d-------- C:\Program Files\usˆugi online
2006-12-19 16:18 -------- d-------- C:\Program Files\movie maker
2006-12-19 16:18 -------- d-------- C:\Program Files\Common Files\mssoap
2006-12-19 16:16 -------- d-------- C:\Program Files\windows nt
2006-12-19 16:16 -------- d-------- C:\Program Files\msn gaming zone
2006-12-19 16:16 -------- d-------- C:\Program Files\messenger
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"SpeedX"="C:\\SpeedX.exe"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=""C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe""
"µTorrent"=""C:\\Program Files\\uTorrent\\uTorrent.exe""
"MSMSGS"=""C:\\Program Files\\Messenger\\msmsgs.exe" /background"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"DU Meter"="C:\\Program Files\\DU Meter\\DUMeter.exe"
"Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"KAVPersonal50"=""C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus Personal Pro\\kav.exe" /minimize"
"SunJavaUpdateSched"=""C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe""
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"
"NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe"
"Samsung Common SM"=""C:\\WINDOWS\\Samsung\\ComSMMgr\\ssmmgr.exe" /autorun"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
"!AVG Anti-Spyware"=""C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe" /minimized"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{2C1CD3D7-86AC-4068-93BC-A02304B60787}"="DCOM Server 60787"
"{2C1CD3D7-86AC-4068-93BC-A02304B37389}"="DCOM Server 37389"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000001
"Wallpaper"="C:\\WINDOWS\\desktop.html"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktopChanges"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktop"=dword:00000000
"ForceActiveDesktopOn"=dword:00000001
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
"zbznjvvc"=""C:\\DOCUME~1\\KROKU\\USTAWI~1\\Temp\\zbznjvvc.exe " "
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
Completion time: 07-02-01 20:32:12
C:\ComboFix2.txt ... 07-02-01 13:07
C:\ComboFix3.txt ... 07-02-01 12:36
przez Aqui 01 Lut 2007, 22:15
Start -> uruchom -> services.msc -> zatrzymaj i wyłącz usługi
IN - Sysinternals - www.sysinternals.com,WKLTSPV - Sysinternals - www.sysinternals.com
Otwórz hijackthis -> open misc tools section -> delete a NT service ->
wpisz N - Sysinternals - www.sysinternals.com ,WKLTSPV - Sysinternals - www.sysinternals.com , i ok
O23 - Service: IN - Sysinternals - www.sysinternals.com - C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\IN.exe
Unknown
O23 - Service: WKLTSPV - Sysinternals - www.sysinternals.com - C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\WKLTSPV.exe
Rootkit >>> zaznaczone Pokaż wszystko >>> wskazane tylko Usługi >>> Szukaj >>> Kopiuj >>> CTRL+V do posta
- Rootkit >>> odznaczone Pokaż wszystko >>> wskazane wszystkie obiekty do skanu >>> Szukaj >>> Kopiuj >>> CTRL+V do posta
Użytkownicy przeglądający to forum: Brak zarejestrowanych użytkowników oraz 11 gości