przez kajtekjr 25 Paź 2007, 15:41
Witam! Ostatnio cos necik muli, po tescie na stronkach internetowych wychodzi ze mam download 100-200 kbps (przy pobieraniu z programosy.pl nie przekroczyłem 20 kB/s)
Przy Neo 1024 kbps wiec raczej to nie jest normalna sytuacja.. A nie wiem czy to wina mojego kompa czy musze dzwonic do TPsa i wstrzasnac tamtym towarzystwem...
- Kod: Zaznacz wszystko
Logfile of HijackThis v1.99.1
Scan saved at 15:33:24, on 2007-10-25
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\nvraidservice.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AutoConnect\AutoConnect.exe
C:\WINDOWS\System32\wbem\unsecapp.exe
C:\Program Files\ITE\Smart Guardian\ITESMART.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
D:\DVD - FOLDER ROBOCZY! NIE USUWAC!\Usuwanie wirusów\HijackThis 1.99.1\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [amd_dc_opt] "C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice
O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.04\RivaTuner.exe" /S
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - Startup: Smart Guardian.lnk = ?
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Szybkie dostosowywanie programu Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O17 - HKLM\System\CCS\Services\Tcpip\..\{BE497ED7-FCFD-4F78-8586-5572DA80FC63}: NameServer = 194.204.159.1 217.98.63.164
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\Admin\USTAWI~1\Temp\hpdj.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
- Kod: Zaznacz wszystko
"Silent Runners.vbs", revision 48, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"AutoConnect" = "C:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"]
"AlcoholAutomount" = ""C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount" ["Alcohol Soft Development Team"]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"NVRaidService" = "C:\WINDOWS\system32\nvraidservice.exe" ["NVIDIA Corporation"]
"CTSysVol" = "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r" ["Creative Technology Ltd"]
"P17Helper" = "Rundll32 P17.dll,P17Helper" [MS]
"UpdReg" = "C:\WINDOWS\UpdReg.EXE" ["Creative Technology Ltd."]
"amd_dc_opt" = ""C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe"" [null data]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "]
"Outpost Firewall" = "C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice" ["Agnitum Ltd."]
"OutpostFeedBack" = "C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup" ["Agnitum Ltd."]
"SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"]
"Synchronization Manager" = "C:\WINDOWS\system32\mobsync.exe /logon" [MS]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"RivaTunerStartupDaemon" = ""C:\Program Files\RivaTuner v2.04\RivaTuner.exe" /S" [empty string]
"MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References"
-> {HKLM...CLSID} = "ShellLink for Application References"
\InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS]
"{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References"
-> {HKLM...CLSID} = "Shell Icon Handler for Application References"
\InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS]
"{45670FA8-ED97-4F44-BC93-305082590BFB}" = "Microsoft.XPS.Shell.Metadata.1"
-> {HKLM...CLSID} = "Windows XPS Document Metadata Handler"
\InProcServer32\(Default) = "C:\WINDOWS\System32\XPSSHHDR.DLL" [MS]
"{44121072-A222-48f2-A58A-6D9AD51EBBE9}" = "Microsoft.XPS.Shell.Thumbnail.1"
-> {HKLM...CLSID} = "Windows XPS Document Thumbnail Handler"
\InProcServer32\(Default) = "C:\WINDOWS\System32\XPSSHHDR.DLL" [MS]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{35786D3C-B075-49b9-88DD-029876E11C01}" = "Portable Devices"
-> {HKLM...CLSID} = "Portable Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshext.dll" [MS]
"{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8}" = "Portable Devices Menu"
-> {HKLM...CLSID} = "Portable Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshext.dll" [MS]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons"
-> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
"{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "Nokia Phone Browser"
-> {HKLM...CLSID} = "Nokia Phone Browser"
\InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"]
"{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Folder przesyłania Share-to-Web"
-> {HKLM...CLSID} = "Folder przesyłania Share-to-Web"
\InProcServer32\(Default) = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}" = "AQQ File Transfer Shell Extension"
-> {HKLM...CLSID} = "AQQ File Transfer Shell Extension"
\InProcServer32\(Default) = "D:\MOJEDO~1\Natalia\AQQ\System\AQQSHE~1.DLL" [file not found]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
-> {HKLM...CLSID} = "iTunes"
\InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Inc."]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
-> {HKLM...CLSID} = "WPDShServiceObj Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]
HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
AQQFileTransfer\(Default) = "{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}"
-> {HKLM...CLSID} = "AQQ File Transfer Shell Extension"
\InProcServer32\(Default) = "D:\MOJEDO~1\Natalia\AQQ\System\AQQSHE~1.DLL" [file not found]
ASW\(Default) = "{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}"
-> {HKLM...CLSID} = "Outpost.ASWShellExt Component"
\InProcServer32\(Default) = "C:\Program Files\Agnitum\Outpost Firewall\op_shell.dll" ["Agnitum Ltd."]
Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}"
-> {HKLM...CLSID} = "NeroCoverEdContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ASW\(Default) = "{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}"
-> {HKLM...CLSID} = "Outpost.ASWShellExt Component"
\InProcServer32\(Default) = "C:\Program Files\Agnitum\Outpost Firewall\op_shell.dll" ["Agnitum Ltd."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
ASW\(Default) = "{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}"
-> {HKLM...CLSID} = "Outpost.ASWShellExt Component"
\InProcServer32\(Default) = "C:\Program Files\Agnitum\Outpost Firewall\op_shell.dll" ["Agnitum Ltd."]
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
Active Desktop and Wallpaper:
-----------------------------
Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp"
Startup items in "Admin" & "All Users" startup folders:
-------------------------------------------------------
C:\Documents and Settings\Admin\Menu Start\Programy\Autostart
"Smart Guardian" -> shortcut to: "C:\Program Files\ITE\Smart Guardian\ITESMART.EXE" ["ITE Tech. Inc."]
Enabled Scheduled Tasks:
------------------------
"AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task" ["Apple Inc."]
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 12
%SystemRoot%\system32\mswsock.dll [MS], 06 - 09, 13 - 22
%SystemRoot%\system32\rsvpsp.dll [MS], 10 - 11
Toolbars, Explorer Bars, Extensions:
------------------------------------
Explorer Bars
Dormant Explorer Bars in "View, Explorer Bar" menu
HKLM\Software\Classes\CLSID\{A1A7E22D-1587-4230-8F16-081C68D21448}\(Default) = "Szybkie dostosowywanie programu"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll" ["Agnitum Ltd."]
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.6.0_03"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.6.0_03"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll" ["Sun Microsystems, Inc."]
{44627E97-789B-40D4-B5C2-58BD171129A1}\
"ButtonText" = "Szybkie dostosowywanie programu Outpost Firewall Pro"
{E2E2DD38-D088-4134-82B7-F2BA38496583}\
"MenuText" = "@xpsp3res.dll,-20001"
"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]
Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------
Apple Mobile Device, Apple Mobile Device, ""C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"" ["Apple, Inc."]
IviRegMgr, IviRegMgr, "C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe" ["InterVideo"]
LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
Outpost Firewall Service, OutpostFirewall, "C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /service" ["Agnitum Ltd."]
StarWind AE Service, StarWindServiceAE, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe" ["Rocket Division Software"]
Windows Driver Foundation - User-mode Driver Framework, WudfSvc, "C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup" {"C:\WINDOWS\System32\WUDFSvc.dll" [MS]}
Print Monitors:
---------------
HKLM\System\CurrentControlSet\Control\Print\Monitors\
hpzsnt08\Driver = "hpzsnt08.dll" ["HP"]
----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 105 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 10 seconds.
---------- (total run time: 131 seconds)
- Kod: Zaznacz wszystko
ComboFix 07-10-23.1 - Admin 2007-10-25 15:42:54.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1498 [GMT 2:00]
Running from: D:\DVD - FOLDER ROBOCZY! NIE USUWAC!\Usuwanie wirus˘w\ComboFix\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2007-09-25 to 2007-10-25 )))))))))))))))))))))))))))))))
.
2007-10-24 14:56 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\K-Meleon
2007-10-24 08:53 <DIR> d-------- C:\WINDOWS\ShellNew
2007-10-24 08:39 <DIR> d-------- C:\UniScan
2007-10-23 21:31 <DIR> d-------- C:\Program Files\NAPI-PROJEKT
2007-10-23 12:53 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Nokia Multimedia Player
2007-10-20 17:05 <DIR> d-------- C:\Fraps
2007-10-20 14:44 <DIR> d-------- C:\Program Files\Common Files\DirectX
2007-10-20 14:44 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\THQ
2007-10-20 14:42 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-10-20 14:15 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\fltk.org
2007-10-19 20:37 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\The Bat!
2007-10-19 14:53 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2007-10-15 19:46 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2007-10-15 19:45 <DIR> d-------- C:\Program Files\AGEIA Technologies
2007-10-15 08:10 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Thunderbird
2007-10-15 08:10 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Talkback
2007-10-15 08:10 0 --a------ C:\WINDOWS\nsreg.dat
2007-10-14 22:36 <DIR> d-------- C:\Program Files\Gimnazjum klasa 3 - Chemia
2007-10-13 09:13 <DIR> d-------- C:\Program Files\iTunes
2007-10-13 09:13 <DIR> d-------- C:\Program Files\iPod
2007-10-13 09:13 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Apple Computer
2007-10-13 09:12 <DIR> d-------- C:\Program Files\Common Files\Apple
2007-10-13 09:04 <DIR> d-------- C:\Program Files\QuickTime
2007-10-12 21:18 <DIR> d-------- C:\WINDOWS\pss
2007-10-11 17:14 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\InterVideo
2007-10-11 17:13 <DIR> d-------- C:\Program Files\Apple Software Update
2007-10-11 17:12 <DIR> d-------- C:\Program Files\InterVideo Information Service
2007-10-11 17:12 <DIR> d-------- C:\Program Files\Common Files\Ulead
2007-10-11 17:07 <DIR> d-------- C:\Program Files\InterVideo
2007-10-11 17:07 <DIR> d-------- C:\Program Files\Common Files\InterVideo
2007-10-11 13:03 1,758 --a------ C:\WINDOWS\unins000.dat
2007-10-11 09:58 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-08 20:12 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Leadertech
2007-10-08 20:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\AdobeUM
2007-10-08 20:02 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\AdobeAUM
2007-10-07 12:55 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll
2007-10-07 12:55 68,888 --a------ C:\WINDOWS\xinput1_3.dll
2007-10-06 20:31 <DIR> d-------- C:\Documents and Settings\Admin\WapSter
2007-10-06 20:30 12,800 --a------ C:\WINDOWS\system32\WING32.DLL
2007-10-06 20:29 <DIR> d-------- C:\Program Files\DK
2007-10-06 09:12 <DIR> d---s---- C:\Documents and Settings\Admin\UserData
2007-10-05 14:28 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2007-10-04 22:12 <DIR> d-------- C:\FirefoxPortable
2007-10-04 19:16 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-04 15:27 <DIR> d--h----- C:\Documents and Settings\Download\Ustawienia lokalne
2007-10-04 15:27 <DIR> dr------- C:\Documents and Settings\Download\Ulubione
2007-10-04 15:27 <DIR> d--h----- C:\Documents and Settings\Download\Szablony
2007-10-04 15:27 <DIR> d-------- C:\Documents and Settings\Download\Pulpit
2007-10-04 15:27 <DIR> dr------- C:\Documents and Settings\Download\Moje dokumenty
2007-10-04 15:27 <DIR> dr------- C:\Documents and Settings\Download\Menu Start
2007-10-04 15:27 <DIR> d-------- C:\Documents and Settings\Download\Dane aplikacji\PC Suite
2007-10-04 15:27 <DIR> d-------- C:\Documents and Settings\Download\Dane aplikacji\Folder przesyania Share-to-Web
2007-10-04 15:27 <DIR> dr-h----- C:\Documents and Settings\Download\Dane aplikacji
2007-10-04 15:18 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\PC Suite
2007-10-04 15:18 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Folder przesyania Share-to-Web
2007-10-04 14:53 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\CyberLink
2007-10-04 13:55 <DIR> d-------- C:\Documents and Settings\Admin\Phone Browser
2007-10-03 20:19 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Avant Profiles
2007-10-03 19:49 <DIR> d-------- C:\Program Files\vso
2007-10-03 19:49 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Vso
2007-10-03 19:49 217,127 --a------ C:\WINDOWS\system32\drv43260.dll
2007-10-03 19:49 208,935 --a------ C:\WINDOWS\system32\drv33260.dll
2007-10-03 19:49 176,165 --a------ C:\WINDOWS\system32\drv23260.dll
2007-10-03 19:49 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2007-10-03 19:49 47,360 --a------ C:\Documents and Settings\Admin\Dane aplikacji\pcouffin.sys
2007-10-03 19:37 <DIR> d-------- C:\Program Files\CyberLink
2007-10-03 19:36 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-10-03 19:33 327,168 --a------ C:\WINDOWS\IsUn0415.exe
2007-10-03 19:20 82,380 --a------ C:\WINDOWS\system32\drivers\AFS2K.SYS
2007-10-03 19:19 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Folder przesyania Share-to-Web
2007-10-03 19:19 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-10-03 19:19 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2007-10-03 19:17 <DIR> d-------- C:\Program Files\Hewlett-Packard
2007-10-03 19:17 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2007-10-03 19:05 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2007-10-03 19:05 <DIR> d-------- C:\Program Files\Common Files\Nokia
2007-10-03 19:05 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\Nokia
2007-10-03 19:04 <DIR> d-------- C:\Program Files\DIFX
2007-10-03 19:03 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-10-03 19:03 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2007-10-03 19:03 <DIR> d-------- C:\Program Files\Nokia
2007-10-03 19:03 <DIR> d-------- C:\Documents and Settings\Admin\Dane aplikacji\PC Suite
2007-10-03 19:03 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2007-10-03 19:03 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2007-10-03 19:03 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2007-10-03 19:03 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2007-10-03 19:03 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys
2007-10-03 19:03 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2007-10-03 17:58 <DIR> d-------- C:\Program Files\Creative
2007-10-03 17:57 <DIR> d-------- C:\Program Files\ITE
2007-10-03 17:57 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-10-03 17:57 118,784 --a------ C:\WINDOWS\system32\Msstdfmt.dll
2007-10-03 17:57 102,912 --a------ C:\WINDOWS\system32\Ntport.dll
2007-10-03 17:57 46,080 --a------ C:\WINDOWS\system32\itevio.dll
2007-10-03 17:57 6,080 --a------ C:\WINDOWS\system32\drivers\zntport.sys
2007-10-03 17:52 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2007-10-03 17:50 <DIR> dr------- C:\Program Files
2007-10-03 17:50 <DIR> dr-h----- C:\Documents and Settings\Default User\Ustawienia lokalne
2007-10-03 17:50 <DIR> d-------- C:\Documents and Settings\Default User\Ulubione
2007-10-03 17:50 <DIR> d--h----- C:\Documents and Settings\Default User\Szablony
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-25 13:29 --------- d-----w C:\Program Files\AutoConnect
2007-10-19 12:56 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-15 17:45 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-10-04 13:27 --------- d-----w C:\Documents and Settings\Download\Dane aplikacji\Folder przesyłania Share-to-Web
2007-10-04 13:18 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Folder przesyłania Share-to-Web
2007-10-03 17:25 --------- d-----w C:\Program Files\Opera
2007-10-03 17:19 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Folder przesyłania Share-to-Web
2007-10-03 16:54 --------- d-----w C:\Program Files\Common Files\LightScribe
2007-10-03 16:52 --------- d-----w C:\Documents and Settings\Admin\Dane aplikacji\Nero
2007-10-03 16:51 --------- d-----w C:\Program Files\Common Files\Nero
2007-10-03 16:48 --------- d-----w C:\Program Files\Nero
2007-10-03 16:44 --------- d-----w C:\Program Files\UltraISO
2007-10-03 16:44 --------- d-----w C:\Program Files\Common Files\EZB Systems
2007-10-03 16:43 --------- d-----w C:\Program Files\Alcohol Soft
2007-10-03 16:41 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-10-03 16:41 --------- d-----w C:\Program Files\xp-AntiSpy
2007-10-03 16:40 --------- d-----w C:\Program Files\Winamp
2007-10-03 16:39 --------- d-----w C:\Program Files\RivaTuner v2.04
2007-10-03 16:38 --------- d-----w C:\Program Files\Lavalys
2007-10-03 16:38 --------- d-----w C:\Program Files\HyperSnap 6
2007-10-03 16:33 --------- d-----w C:\Program Files\Thomson
2007-10-03 16:32 --------- d-----w C:\Program Files\Real Alternative
2007-10-03 16:32 --------- d-----w C:\Program Files\Media Player Classic
2007-10-03 16:32 --------- d-----w C:\Program Files\K-Lite Codec Pack
2007-10-03 16:31 --------- d-----w C:\Program Files\Avant Browser
2007-10-03 16:30 --------- d-----w C:\Program Files\The Bat!
2007-10-03 16:30 --------- d-----w C:\Program Files\Mozilla Thunderbird
2007-10-03 16:29 --------- d-----w C:\Program Files\Gadu-Gadu
2007-10-03 16:23 --------- d-----w C:\Program Files\Common Files\Agnitum Shared
2007-10-03 16:23 --------- d-----w C:\Program Files\Agnitum
2007-10-03 16:09 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2007-10-03 16:09 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2007-10-03 16:09 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2007-10-03 16:04 --------- d-----w C:\Program Files\AMD
2007-10-03 14:56 --------- d-----w C:\Program Files\microsoft frontpage
2007-10-03 14:54 --------- d-----w C:\Program Files\Usługi online
2007-09-16 23:07 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-09-16 23:07 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-09-16 23:07 8,491,008 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-09-16 23:07 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-09-16 23:07 6,853,088 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-09-16 23:07 6,746,112 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-09-16 23:07 6,344,704 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-09-16 23:07 5,783,040 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-09-16 23:07 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-09-16 23:07 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-09-16 23:07 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-09-16 23:07 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-09-16 23:07 364,544 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-09-16 23:07 36,864 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-09-16 23:07 36,864 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-09-16 23:07 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-09-16 23:07 3,551,232 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-09-16 23:07 3,334,144 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-09-16 23:07 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-09-16 23:07 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll
2007-09-16 23:07 2,371,584 ----a-w C:\WINDOWS\system32\nvwss.dll
2007-09-16 23:07 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll
2007-09-16 23:07 155,716 ----a-w C:\WINDOWS\system32\nvsvc32.exe
2007-09-16 23:07 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe
2007-09-16 23:07 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-09-16 23:07 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2007-09-16 23:07 1,478,656 ----a-w C:\WINDOWS\system32\nview.dll
2007-09-16 23:07 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe
2007-09-16 23:07 1,150,976 ----a-w C:\WINDOWS\system32\nvmobls.dll
2007-09-16 23:07 1,019,904 ----a-w C:\WINDOWS\system32\nvwimg.dll
2007-09-11 06:55 81,920 ----a-w C:\WINDOWS\system32\frapsvid.dll
2007-08-21 06:18 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-04 08:40 972,072 ----a-w C:\WINDOWS\UNRecode.exe
2007-08-04 08:10 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll
2007-08-03 10:52 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
2007-07-31 18:45 69,632 ----a-w C:\WINDOWS\system32\wshext.dll
2007-07-31 18:45 413,696 ----a-w C:\WINDOWS\system32\vbscript.dll
2007-07-31 18:45 36,864 ----a-w C:\WINDOWS\system32\wshcon.dll
2007-07-31 18:45 32,768 ----a-w C:\WINDOWS\system32\dispex.dll
2007-07-31 18:45 163,840 ----a-w C:\WINDOWS\system32\scrobj.dll
2007-07-31 18:45 155,648 ----a-w C:\WINDOWS\system32\scrrun.dll
2007-07-31 18:45 135,168 ----a-w C:\WINDOWS\system32\wscript.exe
2007-07-31 18:45 114,688 ----a-w C:\WINDOWS\system32\cscript.exe
2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-07-29 15:51 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2007-07-25 13:24 1,559,040 ----a-w C:\WINDOWS\system32\xvidcore.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"NVRaidService"="C:\WINDOWS\system32\nvraidservice.exe" [2006-06-01 07:09]
"CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 10:51]
"P17Helper"="P17.dll" [2005-05-03 13:38 C:\WINDOWS\system32\P17.dll]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00]
"amd_dc_opt"="C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe" [2006-06-28 15:42]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07]
"nwiz"="nwiz.exe" [2007-09-17 01:07 C:\WINDOWS\system32\nwiz.exe]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-10-03 18:09]
"Outpost Firewall"="C:\Program Files\Agnitum\Outpost Firewall\outpost.exe" [2006-08-30 10:46]
"OutpostFeedBack"="C:\Program Files\Agnitum\Outpost Firewall\feedback.exe" [2006-09-26 19:36]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 00:44]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07]
"RivaTunerStartupDaemon"="C:\Program Files\RivaTuner v2.04\RivaTuner.exe" [2007-09-15 17:40]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2005-09-28 20:13]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 01:14]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 12:29]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
C:\Documents and Settings\Admin\Menu Start\Programy\Autostart\
Smart Guardian.lnk - C:\Program Files\ITE\Smart Guardian\ITESMART.EXE [2007-10-03 17:57:10]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=C:\Documents and Settings\Admin\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"D:\Moje dokumenty\Natalia\llll\3.0\Apps\apdproxy.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AQQ]
D:\MOJEDO~1\Natalia\AQQ\AQQ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeviceDiscovery]
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
"C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
R0 Si3132r5;SiI-3132 SoftRaid 5 Controller;C:\WINDOWS\system32\DRIVERS\Si3132r5.sys
R1 SandBox;Outpost Firewall Sandbox Driver;\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\Sandbox.SYS
R1 VFILT;Outpost Firewall Kernel Driver;\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\FILTNT.SYS
R3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\ADBLOCK.DLL
R3 AmdTools;AMD Special Tools Driver;C:\WINDOWS\system32\DRIVERS\AmdTools.sys
R3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\ARP.DLL
R3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\CONTENT.DLL
R3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL
R3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL
R3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL
R3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL
R3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL
R3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL
R3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL
R3 P17;Sound Blaster Audigy;C:\WINDOWS\system32\drivers\P17.sys
R3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL
R3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\PROTECT.DLL
R3 RivaTuner32;RivaTuner32;\??\C:\Program Files\RivaTuner v2.04\RivaTuner32.sys
R3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);\??\C:\Program Files\Agnitum\Outpost Firewall\kernel\SECRET.DLL
R3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
.
Contents of the 'Scheduled Tasks' folder
"2007-10-13 07:00:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-25 15:43:55
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-10-25 15:44:17
.
--- E O F ---
Fotografia motoryzacyjna ---> WWW
