proszę o sprawdzenie loga

[zurawski12]

Przeskanowalem kompa prgramem AVG Anti-spyware 7.5 i wykrylom mi jakies badziewia. Usunąłem to co sie dalo i prosze o sprawdzenie czy juz jest wszystko ok.
Tutaj raport ze skana:

Kod: Zaznacz wszystko

AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at:   14:21:00 2007-02-21

+ Scan result:   



C:\WINDOWS\system32\dFdramp.dll -> Adware.Look2Me : Cleaned.
C:\WINDOWS\system32\dLdx9_24.dll -> Adware.Look2Me : Cleaned.
C:\WINDOWS\system32\dyvx.dll -> Adware.Look2Me : Cleaned.
HKU\S-1-5-21-436374069-706699826-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -> Adware.NewDotNet : Cleaned.
C:\Documents and Settings\Grzesiek\Ustawienia lokalne\Temp\VVSNInst.exe -> Adware.SaveNow : Cleaned.
C:\Program Files\DAEMON Tools\SetupDTSB.exe -> Adware.SaveNow : Cleaned.
C:\Program Files\VVSN\__delete_on_reboot__V_V_S_N_._e_x_e_ -> Adware.SaveNow : Cleaned.
C:\System Volume Information\_restore{6FFCC5A5-852A-4764-A572-DB559288CBDC}\RP347\A0105690.exe -> Adware.SaveNow : Cleaned.
C:\WINDOWS\antyvirk.exe -> Dialer.Plsex : Cleaned.
C:\System Volume Information\_restore{6FFCC5A5-852A-4764-A572-DB559288CBDC}\RP292\A0093914.exe -> Logger.Agent : Cleaned.
C:\WINDOWS\patcher.exe -> Logger.Agent : Cleaned.
C:\WINDOWS\system32\Sys\taskmgr.006 -> Not-A-Virus.Monitor.Win32.Ardamax.24 : Cleaned.
C:\WINDOWS\system32\Sys\taskmgr.007 -> Not-A-Virus.Monitor.Win32.Ardamax.24 : Cleaned.
:mozilla.431:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.432:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.433:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.434:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.435:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.436:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.437:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.438:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.439:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.440:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.441:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.442:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.443:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.207:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.208:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.209:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.284:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.108:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.109:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.110:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.125:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.126:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.127:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.269:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.270:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.271:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.804:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.805:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.87:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.88:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.891:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.892:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adocean : Cleaned.
C:\Documents and Settings\Grzesiek\Cookies\grzesiek@ad.adocean[1].txt -> TrackingCookie.Adocean : Cleaned.
C:\Documents and Settings\Grzesiek\Cookies\grzesiek@my.adocean[1].txt -> TrackingCookie.Adocean : Cleaned.
C:\RECYCLER\S-1-5-21-436374069-706699826-854245398-1003\Dc29.txt -> TrackingCookie.Adocean : Cleaned.
C:\RECYCLER\S-1-5-21-436374069-706699826-854245398-1003\Dc36.txt -> TrackingCookie.Adocean : Cleaned.
:mozilla.781:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.782:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.17:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.272:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.273:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.274:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.292:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.771:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.968:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned.
:mozilla.820:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Paycounter : Cleaned.
:mozilla.784:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.157:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.158:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.159:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.160:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.161:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.162:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.163:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.164:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.165:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.166:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.167:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.168:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.169:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.170:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.171:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.172:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.173:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.174:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.175:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.176:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.177:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.178:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.179:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.180:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.181:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.182:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.183:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.184:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.185:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.186:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.187:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.188:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.189:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.190:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.191:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.192:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.193:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.194:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.195:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.196:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.197:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.198:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.199:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.200:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.201:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.202:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.203:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.204:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.205:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.206:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.cenzura-spam : Cleaned.
:mozilla.244:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.245:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.246:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.247:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.248:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.249:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.776:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.777:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.13:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.14:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.15:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.16:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\Documents and Settings\Grzesiek\Cookies\grzesiek@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\RECYCLER\S-1-5-21-436374069-706699826-854245398-1003\Dc32.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.302:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Trafic : Cleaned.
:mozilla.55:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.56:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.57:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.58:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.59:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.60:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.61:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.62:C:\Documents and Settings\Grzesiek\Dane aplikacji\Mozilla\Firefox\Profiles\ht9izzs0.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\WINDOWS\teller2.chk -> Trojan.Small : Cleaned.
::Report end

tutaj log z HijackThis v1.99.1

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 14:57:38, on 2007-02-21
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
C:\PROGRA~1\NEOSTR~1\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Watch.exe
C:\Program Files\Konnekt\konnekt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Grzesiek\Pulpit\Nowy folder\HijackThis_v1.99.1.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
R3 - URLSearchHook: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll (file missing)
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart
O4 - HKCU\..\Run: [FreeCall] "C:\Program Files\FreeCall.com\FreeCall\FreeCall.exe" -nosplash -minimized
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gaduuuuuuuuuuu\gg.exe" /tray
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{D8FBC3F8-E7BF-48BB-A28C-7923F5A906C7}: NameServer = 194.204.152.34 217.98.63.164
O20 - Winlogon Notify: DateTime - C:\WINDOWS\system32\en2ql1f51.dll (file missing)
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Proszę o odpowiedź czy jeszcze mam cos zrobic czy komp jest czysty.

[Red]

do usuniecia masz jeszcze:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
O4 - HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe
O20 - Winlogon Notify: DateTime - C:\WINDOWS\system32\en2ql1f51.dll (file missing)

zaznacz w hijacku i usun,to co pogrubilem wywal recznie z program files

[zurawski12]

Mam jeszcze takie pytanie:
Gdy włacze kompa w trybie awaryjnym, i z wyłaczonym przywracaniem systemu i usune to co trzeba to potem juz kompa urochamiac normalnie ? i czy mam spowrotem wlaczyc przywracanie systemu?

[wojtas]

Gdy włacze kompa w trybie awaryjnym, i z wyłaczonym przywracaniem systemu i usune to co trzeba to potem juz kompa urochamiac normalnie ? i czy mam spowrotem wlaczyc przywracanie systemu?

potem daj nowe logi i jak powiemy ze jest ok to wtedy wlaczysz przywracanie

dodatkowo uzyj:

http://www.programosy.pl/program,destroyer.html

i potem daj nowe logi z hijacka , silent runners oraz z L2Mfix z opcji 1

L2Mfix
http://www.downloads.subratam.org/l2mfix.exe

[zurawski12]

zrobilem wszystko tutaj sa logi:

hijacka:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 18:41:04, on 2007-02-21
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
C:\PROGRA~1\NEOSTR~1\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Watch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Grzesiek\Pulpit\Nowy folder\HijackThis_v1.99.1.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
R3 - URLSearchHook: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll (file missing)
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gaduuuuuuuuuuu\gg.exe" /tray
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{D8FBC3F8-E7BF-48BB-A28C-7923F5A906C7}: NameServer = 194.204.152.34 217.98.63.164
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

SILENT:

Kod: Zaznacz wszystko

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Konnekt" = ""C:\Program Files\Konnekt\konnekt.exe" /autostart" ["Stamina"]
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gaduuuuuuuuuuu\gg.exe" /tray" ["Gadu-Gadu S.A."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"]
"WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"]
"WooCnxMon" = "C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string]
"VVSN" = "C:\Program Files\VVSN\VVSN.exe" [file not found]
"ISUSPM Startup" = "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup" ["InstallShield Software Corporation"]
"ISUSScheduler" = ""C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start" ["InstallShield Software Corporation"]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"AVG7_CC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"DAEMON Tools" = ""C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."]
"!AVG Anti-Spyware" = ""C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized" ["Anti-Malware Development a.s."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
  -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
                   \InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
                   \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
  -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
                   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
  -> {HKLM...CLSID} = "RealOne Player Context Menu Class"
                   \InProcServer32\(Default) = "C:\Program Files\nowy folderek\rpshell.dll" ["RealNetworks, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
  -> {HKLM...CLSID} = "DesktopContext Class"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
  -> {HKLM...CLSID} = "Desktop Explorer"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
  -> {HKLM...CLSID} = "nView Desktop Context Menu"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension"
  -> {HKLM...CLSID} = "AVG7 Shell Extension Class"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension"
  -> {HKLM...CLSID} = "AVG7 Find Extension Class"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
  -> {HKLM...CLSID} = "NVIDIA CPL Extension"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5"
  -> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\
<<!>> "AppInit_DLLs" = "NVDESK32.DLL" [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
  -> {HKLM...CLSID} = "PDF Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
  -> {HKLM...CLSID} = "CContextScan Object"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."]
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
  -> {HKLM...CLSID} = "AVG7 Shell Extension Class"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
WinUHA\(Default) = "{095177B8-8097-4D32-9081-A8949C47020E}"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "D:\WinUHA\shellwinuha.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
  -> {HKLM...CLSID} = "CContextScan Object"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
  -> {HKLM...CLSID} = "AVG7 Shell Extension Class"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
WinUHA\(Default) = "{095177B8-8097-4D32-9081-A8949C47020E}"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "D:\WinUHA\shellwinuha.dll" [null data]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"DisableRegistryTools" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|System|
Prevent access to registry editing tools}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Grzesiek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]


Enabled Scheduled Tasks:
------------------------

"At1" -> launches: "C:\WINDOWS\system32\wunauclt.exe" [file not found]
"At2" -> launches: "C:\WINDOWS\system32\wunauclt.exe" [file not found]
"At3" -> launches: "C:\WINDOWS\system32\wunauclt.exe" [file not found]
"At4" -> launches: "C:\WINDOWS\dr.exe" [file not found]
"At5" -> launches: "C:\WINDOWS\user32.exe" [file not found]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

HKLM\Software\Classes\CLSID\{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}\(Default) = "Volet Wanadoo"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}\(Default) = "ToolBand Class"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{5BF498C0-931E-4A4F-B33F-456D07137EAA}\(Default) = "Volet Wanadoo"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]


Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
<<H>> "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided)
  -> {HKLM...CLSID} = "Search Class"
                   \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string]
<<H>> "{A8B28872-3324-4CD2-8AA3-7D555C872D96}" = (no title provided)
  -> {HKLM...CLSID} = "DeskbarBHO"
                   \InProcServer32\(Default) = "C:\Program Files\Deskbar\deskbar.dll" [file not found]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["Anti-Malware Development a.s."]
AVG E-mail Scanner, AVGEMS, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" ["GRISOFT, s.r.o."]
AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."]
AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
Monitor języka PJL\Driver = "PJLMON.DLL" [MS]


----------
<<!>>: Suspicious data at a malware launch point.
<<H>>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
  took 170 seconds.
---------- (total run time: 235 seconds)

L2Mfix:

Kod: Zaznacz wszystko

L2MFIX find log 051206
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
  6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
"Logon"="WLEventLogon"
"Logoff"="WLEventLogoff"
"Startup"="WLEventStartup"
"Shutdown"="WLEventShutdown"
"StartScreenSaver"="WLEventStartScreenSaver"
"StopScreenSaver"="WLEventStopScreenSaver"
"Lock"="WLEventLock"
"Unlock"="WLEventUnlock"
"StartShell"="WLEventStartShell"
"PostShell"="WLEventPostShell"
"Disconnect"="WLEventDisconnect"
"Reconnect"="WLEventReconnect"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000000
"SafeMode"=dword:00000001
"MaxWait"=dword:ffffffff
"DllName"=hex(2):57,00,67,00,61,00,4c,00,6f,00,67,00,6f,00,6e,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Event"=dword:00000024
"InstallNotifyShown"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings]
"Data"=hex:01,00,00,00,d0,8c,9d,df,01,15,d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,\
  00,00,71,48,5a,08,f7,2e,6f,4b,af,fa,f2,62,38,27,49,28,04,00,00,00,04,00,00,\
  00,53,00,00,00,03,66,00,00,a8,00,00,00,10,00,00,00,bf,db,16,63,05,ba,5b,d3,\
  9e,e4,3c,14,d7,d4,9e,27,00,00,00,00,04,80,00,00,a0,00,00,00,10,00,00,00,a3,\
  41,f9,65,b4,cc,00,f2,fe,14,32,43,77,12,86,24,e8,03,00,00,b5,6b,91,a6,30,09,\
  45,12,cd,d9,08,7c,85,9c,44,12,90,41,01,79,c3,ea,b3,55,aa,db,e0,50,24,86,78,\
  ee,da,1d,24,f3,b0,38,bc,e0,f8,4c,8a,58,e3,1e,05,0c,d8,c8,02,72,8b,85,d1,da,\
  be,4f,63,e2,46,71,ec,62,8a,cf,da,44,76,05,b5,84,91,71,a9,31,8f,b8,d5,06,bb,\
  b8,60,c3,12,c3,c5,ba,53,8b,9d,11,6f,d6,d8,32,eb,da,03,96,b6,9b,6d,03,ce,1b,\
  2f,f1,dd,93,f2,62,93,d2,2c,c9,28,50,58,f4,bc,78,f3,f9,ad,ef,db,14,3f,58,db,\
  96,dc,c2,5f,f5,82,c1,b9,d6,0c,5f,d8,55,6d,d6,41,3c,92,12,43,27,64,e8,cf,5d,\
  ae,49,19,45,0b,35,c6,68,3c,f9,d5,57,88,70,51,c0,76,7d,db,c5,20,cd,22,10,5a,\
  6b,fb,da,a6,da,b3,af,e4,23,82,48,70,f7,14,a4,0d,4f,b9,d1,9e,d7,95,7b,6d,d2,\
  2a,d8,80,5f,ed,92,2a,fe,b1,80,bb,9f,08,c5,89,ad,15,86,98,5e,1e,a8,1b,47,e5,\
  cf,ae,91,b3,82,4a,c2,b0,19,51,88,77,0a,42,1c,53,57,e7,4e,64,4c,ca,a0,23,6a,\
  98,58,03,00,e8,81,0d,2c,94,1b,27,35,da,04,5e,0a,15,cd,3a,d9,e0,55,a4,21,26,\
  e6,03,66,c8,14,12,17,d1,8f,ef,8e,04,93,52,f0,95,47,84,cf,58,7d,4b,ae,f2,a6,\
  82,5c,c1,12,c6,b6,f6,a5,a0,2e,76,ba,10,af,c6,a3,18,b8,fc,2f,a9,b5,ed,10,1d,\
  56,c1,9b,e3,54,43,aa,63,94,d2,e6,1a,f5,28,b9,c9,5e,fd,71,f3,a9,08,17,ba,e7,\
  04,86,ef,ca,64,9a,83,75,84,82,41,84,59,5d,37,dd,70,9f,0d,ef,8c,de,75,aa,54,\
  0a,06,89,30,67,8b,a4,81,d1,13,73,51,f2,a1,46,be,68,a7,c6,f8,4b,a9,88,be,a7,\
  75,70,9b,ae,a8,77,32,05,7f,cc,fe,c9,a7,07,9a,be,7b,6f,f6,3d,8c,c3,66,9b,d4,\
  46,4a,4a,4f,fc,8d,d8,5c,dc,54,ab,fe,ef,78,fe,25,4a,8b,08,1f,51,e3,5f,c0,12,\
  04,2a,5a,0d,75,e2,ad,64,c9,0b,ce,9b,1d,c7,7c,44,1e,70,0a,97,05,4c,02,5b,c6,\
  61,ec,0e,e3,cd,37,8d,92,43,bd,e8,f6,2a,fd,dc,a1,05,ad,58,1f,8e,2d,c8,a4,fc,\
  24,5a,e8,82,f6,bd,02,83,04,86,7d,1b,43,ef,d6,b1,48,e1,bb,e5,09,79,2a,08,ce,\
  57,bc,39,05,8d,0a,0c,b4,93,0d,03,6e,22,b1,21,63,fa,01,7a,5f,ad,ae,b2,3c,5b,\
  a8,8e,ec,d5,8e,36,80,b1,1e,ba,a1,c8,1c,c7,e4,c9,bb,f6,48,eb,47,0b,ff,ba,31,\
  36,1a,97,79,4f,51,4c,55,a1,3c,5f,98,80,c7,54,c1,f7,4b,dc,24,ec,ee,62,91,43,\
  79,52,f9,55,a2,88,2d,6c,47,f7,c0,c0,cb,8e,99,2d,af,70,02,7d,24,84,6a,d9,3f,\
  0e,1f,d2,be,4d,77,b0,d9,4a,57,25,b2,2e,7c,5a,35,33,fa,db,6b,c2,0a,0a,48,4c,\
  f6,83,45,eb,b2,f9,09,43,55,30,d3,e3,28,dc,4f,6a,1b,62,04,5f,d6,07,1f,9f,c0,\
  bc,61,dc,d6,85,54,13,c7,22,80,e5,be,cb,c2,0a,72,68,89,a3,cd,61,7e,b0,58,15,\
  0e,eb,1b,d6,d7,d2,a3,f9,3c,0a,c0,ee,e9,66,43,9b,29,d2,38,92,f3,d2,72,fb,d6,\
  ef,e0,f1,6d,e6,36,a4,5e,ad,4e,41,6e,2a,de,64,d4,aa,16,e9,f0,54,c5,e9,3b,95,\
  f4,6b,a2,d9,d4,e9,a3,18,36,bb,93,b7,d6,db,2d,c1,74,74,85,45,47,40,42,bd,eb,\
  9c,fe,f8,9a,af,b4,27,6b,a9,b5,d4,88,38,f6,b6,77,83,55,a8,66,cc,90,a7,9c,96,\
  3c,06,a5,b1,75,80,83,d0,29,3a,87,de,f7,cd,6d,0f,be,e5,15,3d,86,fc,1c,ae,e0,\
  12,68,57,cc,c9,d2,6b,f3,86,c1,21,fe,63,50,fc,10,38,d7,5d,42,cf,4f,5a,3f,b1,\
  5b,42,43,95,74,c5,84,dc,1e,74,03,51,82,a2,29,68,f7,41,fb,e0,15,9d,24,26,a4,\
  5e,bf,be,a7,eb,ed,e9,56,40,ed,d9,53,e8,50,67,b2,ea,a7,eb,a7,d6,a8,68,f5,e7,\
  89,e8,6e,14,cd,83,8b,4a,47,2c,72,2b,95,9a,a1,7a,a3,c8,65,0e,c8,a7,37,20,c8,\
  72,69,3c,30,47,47,8b,06,2d,5a,71,f0,74,de,59,97,49,cf,4a,c3,fd,88,b0,d8,e1,\
  d3,d8,87,4a,5a,34,b0,66,23,06,f9,dc,3f,95,af,59,47,3f,8d,fd,b3,51,35,22,dd,\
  20,7a,ab,1b,85,33,48,35,3a,54,13,73,36,fb,25,0a,1d,97,a4,14,00,00,00,93,e6,\
  96,c7,2e,04,a5,af,b5,0c,55,d6,d8,46,7b,c4,02,4c,76,68

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"sv1"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Karta wˆa˜ciwo˜ci pliku multimedialnego"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ZarzĄdzanie skanerem ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Strona zabezpieczeä NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Strona wˆa˜ciwo˜ci OLE Docfile"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Rozszerzenia powˆoki dla udost©pniania zasob˘w"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Rozszerzenie CPL karty graficznej"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Rozszerzenie CPL monitora wy˜wietlania"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Rozszerzenie CPL kadrowania wy˜wietlania"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Strona zabezpieczeä usˆugi DS"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Strona zgodno˜ci"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Program obsˆugi danych wycinkowych powˆoki"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Rozszerzenie Disc Copy"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Rozszerzenia powˆoki dla obiekt˘w Microsoft Windows Network"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ZarzĄdzanie monitorem ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ZarzĄdzanie drukarkĄ ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Rozszerzenia powˆoki dla kompresji plik˘w"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Rozszerzenie powˆoki drukarek sieci Web"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu kontekstowe szyfrowania"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Akt˘wka"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Rozszerzenie ikony HyperTerminalu"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Strona zabezpieczeä drukarek"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Rozszerzenia powˆoki dla udost©pniania zasob˘w"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Rozszerzenie Crypto PKO"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Rozszerzenie Crypto Sign"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="PoˆĄczenia sieciowe"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="PoˆĄczenia sieciowe"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Skanery i aparaty fotograficzne"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Skanery i aparaty fotograficzne"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="&Skanery i aparaty fotograficzne"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Skanery i aparaty fotograficzne"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Skanery i aparaty fotograficzne"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Zaplanowane zadania"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Pasek zadaä i menu Start"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Wyszukaj"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Pomoc i obsˆuga techniczna"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Pomoc i obsˆuga techniczna"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Uruchom..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Czcionki"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Narz©dzia administracyjne"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Pasek narz©dzi programu Microsoft Internet"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Stan pobierania"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Folder powˆoki zwi©kszonej"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Folder powˆoki zwi©kszonej 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Pasek przeglĄdarki Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Pasek wyszukiwania"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Pasek multimedi˘w"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Wyszukiwanie w okienku"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Wyszukiwanie w sieci Web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Narz©dzie opcji drzewa rejestru"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adres"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Pole edycji adresu"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Autouzupeˆnianie Microsoft"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="Wyodr©bnianie obraz˘w Trident"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="Lista autouzupeˆniania MRU"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Niestandardowa lista autouzupeˆniania MRU"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Dost©pny"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Pasek podr©czny ˜ledzenia"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analizator paska adresu"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Lista autouzupeˆniania historii Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Lista autouzupeˆniania folderu powˆoki Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Kontener wielu list autouzupeˆniania Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu witryny paska powˆoki"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Pasek pulpitu powˆoki"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Pomoc dla uľytkownika"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Globalne ustawienia folder˘w"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historia"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Tymczasowe pliki internetowe"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Tymczasowe pliki internetowe"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Ekran powitalny pakietu IE4"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Pasek eksploratora"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Folder pami©ci podr©cznej ActiveX"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Folder subskrypcji"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Menedľer aplikacji powˆoki"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Wyliczanie zainstalowanych aplikacji"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Publikator aplikacji Darwin"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+program wyodr©bniajĄcy miniatury plik˘w"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Informacje podsumowujĄce obsˆugi miniatur (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Wyodr©bnianie miniatur HTML"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Kreator publikacji w sieci Web"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Zamawianie odbitek w sieci Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Obiekt powˆoki kreatora publikacji"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Kreator uzyskiwania profilu usˆugi Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Konta uľytkownik˘w"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Plik kanaˆu"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Skr˘t kanaˆu"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Obiekt obsˆugi kanaˆu"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Folder plik˘w trybu offline"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="&Do os˘b..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band"
"{32020A01-506E-484D-A2A8-BE3CF17601C3}"="AlcoholShellEx"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
"{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension"
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension"
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"

**********************************************************************************
HKEY ROOT CLASSIDS:
**********************************************************************************
Files Found are not all bad files:

No matches found.
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Wolumin w stacji C nie ma etykiety.
Numer seryjny woluminu: 2093-D0F5

Katalog: C:\WINDOWS\System32

2007-02-21  14:22    <DIR>          dllcache
2007-02-21  14:20    <DIR>          Sys
2005-12-31  17:52    <DIR>          Microsoft
               0 plik(˘w)               0 bajt˘w
               3 katalog(˘w)   6˙485˙250˙048 bajt˘w wolnych

Poza tym sprawdzilem takze destroyerem kompa.
Prosze o odpowiedz czy jeszcze cos usunac, czy moge juz przelaczyc na przywracanie systemu. Z góry dziekuje

[wojtas]

skasuj:

O4 - HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)

najpierw wpisy potem pogrubione

w notatniku wklej:

schtasks /delete /TN At1 /F
schtasks /delete /TN At2 /F
schtasks /delete /TN At3 /F
schtasks /delete /TN At4 /F
schtasks /delete /TN At5 /F

Z menu Notatnika >>> Plik >>> Zapisz jako >>> Ustaw rozszerzenie na Wszystkie pliki >>> Zapisz jako FIX.BAT >>> uruchom plik

[zurawski12]

Zrobilem tak jak mówiles i teraz wygląda to tak:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 20:39:07, on 2007-02-21
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\Program Files\Neostrada TP\ComComp.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Grzesiek\Pulpit\Nowy folder\HijackThis_v1.99.1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
R3 - URLSearchHook: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll (file missing)
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gaduuuuuuuuuuu\gg.exe" /tray
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{D8FBC3F8-E7BF-48BB-A28C-7923F5A906C7}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[wojtas]

jeszcze silenta pokaz

[zurawski12]

Kod: Zaznacz wszystko

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Konnekt" = ""C:\Program Files\Konnekt\konnekt.exe" /autostart" ["Stamina"]
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gaduuuuuuuuuuu\gg.exe" /tray" ["Gadu-Gadu S.A."]

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\ {++}
"^SetupICWDesktop" = "(empty string)" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"]
"WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"]
"WooCnxMon" = "C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string]
"ISUSPM Startup" = "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup" ["InstallShield Software Corporation"]
"ISUSScheduler" = ""C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start" ["InstallShield Software Corporation"]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"AVG7_CC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"DAEMON Tools" = ""C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."]
"!AVG Anti-Spyware" = ""C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized" ["Anti-Malware Development a.s."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
  -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
                   \InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
                   \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
  -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
                   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
  -> {HKLM...CLSID} = "RealOne Player Context Menu Class"
                   \InProcServer32\(Default) = "C:\Program Files\nowy folderek\rpshell.dll" ["RealNetworks, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
  -> {HKLM...CLSID} = "DesktopContext Class"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
  -> {HKLM...CLSID} = "Desktop Explorer"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
  -> {HKLM...CLSID} = "nView Desktop Context Menu"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension"
  -> {HKLM...CLSID} = "AVG7 Shell Extension Class"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension"
  -> {HKLM...CLSID} = "AVG7 Find Extension Class"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
  -> {HKLM...CLSID} = "NVIDIA CPL Extension"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5"
  -> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\
<<!>> "AppInit_DLLs" = "NVDESK32.DLL" [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
  -> {HKLM...CLSID} = "PDF Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
  -> {HKLM...CLSID} = "CContextScan Object"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."]
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
  -> {HKLM...CLSID} = "AVG7 Shell Extension Class"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
WinUHA\(Default) = "{095177B8-8097-4D32-9081-A8949C47020E}"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "D:\WinUHA\shellwinuha.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
  -> {HKLM...CLSID} = "CContextScan Object"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
  -> {HKLM...CLSID} = "AVG7 Shell Extension Class"
                   \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
WinUHA\(Default) = "{095177B8-8097-4D32-9081-A8949C47020E}"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "D:\WinUHA\shellwinuha.dll" [null data]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"DisableRegistryTools" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|System|
Prevent access to registry editing tools}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Grzesiek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

HKLM\Software\Classes\CLSID\{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}\(Default) = "Volet Wanadoo"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}\(Default) = "ToolBand Class"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{5BF498C0-931E-4A4F-B33F-456D07137EAA}\(Default) = "Volet Wanadoo"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]


Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
<<H>> "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided)
  -> {HKLM...CLSID} = "Search Class"
                   \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string]
<<H>> "{A8B28872-3324-4CD2-8AA3-7D555C872D96}" = (no title provided)
  -> {HKLM...CLSID} = "DeskbarBHO"
                   \InProcServer32\(Default) = "C:\Program Files\Deskbar\deskbar.dll" [file not found]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["Anti-Malware Development a.s."]
AVG E-mail Scanner, AVGEMS, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" ["GRISOFT, s.r.o."]
AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."]
AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
Monitor języka PJL\Driver = "PJLMON.DLL" [MS]


----------
<<!>>: Suspicious data at a malware launch point.
<<H>>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
  took 167 seconds.
---------- (total run time: 241 seconds)

[wojtas]

jest czysto

[zurawski12]

Czyli teraz juz moge wlaczyc przywracanie systemu czy ma tak zostac?

[wojtas]

juz wlacz

[zurawski12]

Bardzo dziękuje za pomoc i pozdrawiam