proszę o sprawdzenie logu

**Posty:** 65 · przez **sir_romanek** 28 Sty 2007, 15:58

Podczas skanowania NOD32 dostaję taki komunikat i nie mogę się tego pozbyć

Kod: Zaznacz wszystko: Infekcja prawdopodobnie zmodyfikowany trojan Win32/TrojanDownloader.ConHook została wykryta w pamięci operacyjnej. NOD32 Skaner nie może wyleczyć infekcji. Nie można podjąć żadnej akcji do zainfekowanej pamięci.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 14:47:17, on 2007-01-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\htpatch.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\WINDOWS\system32\msmsgr.exe D:\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\Common Files\DriveCleaner Free\udcsdr.exe C:\Program Files\Common Files\DriveCleaner Free\udcpas.exe C:\WINDOWS\system32\ctfmon.exe D:\Gadu-Gadu\gg.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe D:\NetMeter\NetMeter.exe C:\WINDOWS\system32\nvsvc32.exe D:\Adobe\Acrobat 7.0\Reader\reader_sl.exe d:\Spyware Doctor\sdhelp.exe C:\Program Files\RALINK\Common\RaUI.exe d:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\navsvc.exe d:\PerfectDisk\PDSched.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\sir_romanek\Pulpit\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O3 - Toolbar: Mario Forever Toolbar - {71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7} - C:\Program Files\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\FlashGet\fgiebar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [Microsoft System Firewall 2006.2] msmsgr.exe O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] d:\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [GrooveMonitor] "D:\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime O4 - HKLM\..\Run: [DAEMON Tools] "d:\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [CloneCDTray] "d:\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\system32\xpsoqpap.dll",setvm O4 - HKLM\..\Run: [SDR6_Check] "C:\Program Files\Common Files\DriveCleaner Free\udcsdr.exe" O4 - HKLM\..\Run: [PAS_Check] "C:\Program Files\Common Files\DriveCleaner Free\udcpas.exe" O4 - HKLM\..\RunServices: [Microsoft System Firewall 2006.2] msmsgr.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ProxyWay] D:\ProxyWay\proxyway.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [D:\NetMeter\NetMeter.exe] D:\NetMeter\NetMeter.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Net Sentinel.lnk = D:\Net Sentinel\NS.exe O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - D:\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - D:\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://D:\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\flashget.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: SmartWhois - {FD9DE2B4-C926-4460-81C4-FC58C6F1062E} - D:\SmartWhois\swmsie.exe O9 - Extra button: (no name) - {FF983118-58C7-4AD4-B5A7-691C39CB7B42} - D:\SmartWhois\swmsie.exe O9 - Extra 'Tools' menuitem: SmartWhois - {FF983118-58C7-4AD4-B5A7-691C39CB7B42} - D:\SmartWhois\swmsie.exe O11 - Options group: [INTERNATIONAL] International* O17 - HKLM\System\CCS\Services\Tcpip\..\{8FB017F1-3F52-4D56-B10B-DB6115CEA35A}: NameServer = 194.204.159.1,194.204.152.34 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PDEngine - Raxco Software, Inc. - d:\PerfectDisk\PDEngine.exe O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - d:\PerfectDisk\PDSched.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - d:\Spyware Doctor\sdhelp.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - d:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Windows Server Management Services (WSMSPSVC) - Unknown owner - C:\WINDOWS\navsvc.exe

**Posty:** 1134 · przez **MISTEJK** 28 Sty 2007, 16:08

Pobierz i uruchom narzędzie : The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\system32\msmsgr.exe
C:\WINDOWS\navsvc.exe
C:\WINDOWS\system32\xpsoqpap.dll

Folders to delete:

C:\Program Files\VSAdd-in

Drivers to unload:

Windows Server Management Services

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/wpisy:

C:\WINDOWS\system32\msmsgr.exe
C:\WINDOWS\navsvc.exe
O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll
O4 - HKLM\..\Run: [Microsoft System Firewall 2006.2] msmsgr.exe
O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\system32\xpsoqpap.dll",setvm
O4 - HKLM\..\RunServices: [Microsoft System Firewall 2006.2] msmsgr.exe
O23 - Service: Windows Server Management Services (WSMSPSVC) - Unknown owner - C:\WINDOWS\navsvc.exe

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z HijackThis + log z Silent Runners.

**Posty:** 65 · przez **sir_romanek** 28 Sty 2007, 16:56

Kod: Zaznacz wszystko: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\qaqjkefj ******************* Script file located at: \??\C:\WINDOWS\system32\icrbggiv.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\system32\msmsgr.exe deleted successfully. File C:\WINDOWS\navsvc.exe deleted successfully. File C:\WINDOWS\system32\xpsoqpap.dll deleted successfully. Folder C:\Program Files\VSAdd-in deleted successfully. Registry key \Registry\Machine\System\CurrentControlSet\Services\Windows Server Management Services not found! Unload of driver Windows Server Management Services failed! Could not process line: Windows Server Management Services Status: 0xc0000034 Completed script processing. ******************* Finished! Terminate.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:43:10, on 2007-01-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe d:\Spyware Doctor\sdhelp.exe d:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe d:\PerfectDisk\PDSched.exe C:\WINDOWS\htpatch.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe D:\Microsoft Office\Office12\GrooveMonitor.exe D:\DAEMON Tools\daemon.exe C:\Program Files\Common Files\DriveCleaner Free\udcsdr.exe C:\Program Files\Common Files\DriveCleaner Free\udcpas.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\ctfmon.exe D:\Gadu-Gadu\gg.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe D:\NetMeter\NetMeter.exe C:\Program Files\RALINK\Common\RaUI.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\sir_romanek\Pulpit\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O3 - Toolbar: Mario Forever Toolbar - {71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7} - C:\Program Files\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\FlashGet\fgiebar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] d:\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [GrooveMonitor] "D:\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime O4 - HKLM\..\Run: [DAEMON Tools] "d:\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [CloneCDTray] "d:\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [SDR6_Check] "C:\Program Files\Common Files\DriveCleaner Free\udcsdr.exe" O4 - HKLM\..\Run: [PAS_Check] "C:\Program Files\Common Files\DriveCleaner Free\udcpas.exe" O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\system32\lugdwcju.dll",setvm O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ProxyWay] D:\ProxyWay\proxyway.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [D:\NetMeter\NetMeter.exe] D:\NetMeter\NetMeter.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Net Sentinel.lnk = D:\Net Sentinel\NS.exe O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - D:\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - D:\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://D:\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\flashget.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: SmartWhois - {FD9DE2B4-C926-4460-81C4-FC58C6F1062E} - D:\SmartWhois\swmsie.exe O9 - Extra button: (no name) - {FF983118-58C7-4AD4-B5A7-691C39CB7B42} - D:\SmartWhois\swmsie.exe O9 - Extra 'Tools' menuitem: SmartWhois - {FF983118-58C7-4AD4-B5A7-691C39CB7B42} - D:\SmartWhois\swmsie.exe O11 - Options group: [INTERNATIONAL] International* O17 - HKLM\System\CCS\Services\Tcpip\..\{8FB017F1-3F52-4D56-B10B-DB6115CEA35A}: NameServer = 194.204.159.1,194.204.152.34 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PDEngine - Raxco Software, Inc. - d:\PerfectDisk\PDEngine.exe O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - d:\PerfectDisk\PDSched.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - d:\Spyware Doctor\sdhelp.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - d:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Windows Server Management Services (WSMSPSVC) - Unknown owner - C:\WINDOWS\navsvc.exe (file missing)

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""D:\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "ProxyWay" = "D:\ProxyWay\proxyway.exe" [file not found] "swg" = "C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe" ["Google Inc."] "D:\NetMeter\NetMeter.exe" = "D:\NetMeter\NetMeter.exe" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "HTpatch" = "C:\WINDOWS\htpatch.exe" [null data] "SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."] "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" [null data] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"" ["Sun Microsystems, Inc."] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}" = "d:\Gmail Notifier\gnotify.exe" ["Google Inc."] "GrooveMonitor" = ""D:\Microsoft Office\Office12\GrooveMonitor.exe"" [MS] "QuickTime Task" = ""C:\WINDOWS\system32\qttask.exe" -atboottime" ["Apple Computer, Inc."] "DAEMON Tools" = ""d:\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "CloneCDTray" = ""d:\SlySoft\CloneCD\CloneCDTray.exe" /s" ["SlySoft, Inc."] "SDR6_Check" = ""C:\Program Files\Common Files\DriveCleaner Free\udcsdr.exe"" [null data] "PAS_Check" = ""C:\Program Files\Common Files\DriveCleaner Free\udcpas.exe"" [null data] "DllRunning" = "rundll32.exe "C:\WINDOWS\system32\lugdwcju.dll",setvm" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "D:\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Flashget Catch Url Class" \InProcServer32\(Default) = "D:\FlashGet\jccatch.dll" ["www.flashget.com"] {34F52EF9-6E00-4508-8490-E0C202201A43}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\fcyyx.dll" [null data] {46A4E9D9-B30E-452A-8157-DBBEC8573B03}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\VSAdd-in\VSAdd-in.dll" [file not found] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\(Default) = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}\(Default) = (no title provided) -> {HKLM...CLSID} = "PCTools Site Guard" \InProcServer32\(Default) = "D:\SPYWAR~1\tools\iesdsg.dll" ["PC Tools"] {72853161-30C5-4D22-B7F9-0BBC1D38A37E}\(Default) = (no title provided) -> {HKLM...CLSID} = "Groove GFS Browser Helper" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."] {A20854FD-DDB5-4931-8F76-D11EA2364D94}\(Default) = (no title provided) -> {HKLM...CLSID} = "Mario Forever Toolbar Helper" \InProcServer32\(Default) = "C:\Program Files\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll" [null data] {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Helper" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] {B56A7D7D-6927-48C8-A975-17DF180C71AC}\(Default) = (no title provided) -> {HKLM...CLSID} = "PCTools Browser Monitor" \InProcServer32\(Default) = "D:\SPYWAR~1\tools\iesdpb.dll" ["PC Tools"] {EF7C999D-43DD-43C3-A25B-2DB1A881664A}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\gebayxv.dll" [null data] {F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided) -> {HKLM...CLSID} = "gFlash Class" \InProcServer32\(Default) = "D:\FlashGet\getflash.dll" [empty string] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{B089FE88-FB52-11d3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "d:\7-Zip\7-zip.dll" ["Igor Pavlov"] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "d:\ALCOHO~2\ALCOHO~1\axshlex.dll" ["Alcohol Soft Development Team"] "{72853161-30C5-4D22-B7F9-0BBC1D38A37E}" = "Groove GFS Browser Helper" -> {HKLM...CLSID} = "Groove GFS Browser Helper" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}" = "Groove GFS Explorer Bar" -> {HKLM...CLSID} = "Groove Folder Synchronization" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{A449600E-1DC6-4232-B948-9BD794D62056}" = "Groove GFS Stub Icon Handler" -> {HKLM...CLSID} = "Groove GFS Stub Icon Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook" -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{6C467336-8281-4E60-8204-430CED96822D}" = "Groove GFS Context Menu Handler" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{387E725D-DC16-4D76-B310-2C93ED4752A0}" = "Groove XML Icon Handler" -> {HKLM...CLSID} = "Groove XML Icon Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{16F3DD56-1AF5-4347-846D-7C10C4192619}" = "Groove Explorer Icon Overlay 3 (GFS Folder)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 3 (GFS Folder)" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" = "Groove Explorer Icon Overlay 2 (GFS Stub)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2 (GFS Stub)" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{99FD978C-D287-4F50-827F-B2C658EDA8E7}" = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{920E6DB1-9907-4370-B3A0-BAFC03D81399}" = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Outlook File Icon Extension" \InProcServer32\(Default) = "D:\MICROS~1\Office12\OLKFSTUB.DLL" [MS] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "D:\MICROS~1\Office12\MLSHEXT.DLL" [MS] "{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" -> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" \InProcServer32\(Default) = "D:\MICROS~1\Office12\ONFILTER.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "D:\Microsoft Office\Office12\msohevi.dll" [MS] "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler" -> {HKLM...CLSID} = "Microsoft Office Metadata Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler" -> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{8903F6C9-25E3-40AC-A98F-E6D35CD0469C}" = "PSPad" -> {HKLM...CLSID} = "PSPad" \InProcServer32\(Default) = "d:\PSPADE~1\PSPADS~1.DLL" [null data] "{63AFBDFB-5EF8-4791-AF79-9A3C0DE48974}" = "EditPlus Context Menu Handler" -> {HKLM...CLSID} = "EditPlus Context Menu Handler" \InProcServer32\(Default) = "d:\EditPlus 2\eppshell.dll" [null data] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "d:\ACE Mega CoDecS Pack\SystemS\RealMedia\rpshell.dll" ["RealNetworks, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook" -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] <<!>> "{EF7C999D-43DD-43C3-A25B-2DB1A881664A}" = "*f" (unwritable string) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\gebayxv.dll" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ <<!>> "BootExecute" = "PDBoot.exe" ["Raxco Software, Inc."]|"autocheck autochk *" HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> Antiwpa\DLLName = "antiwpa.dll" [null data] <<!>> fcyyx\DLLName = "C:\WINDOWS\system32\fcyyx.dll" [null data] <<!>> gebayxv\DLLName = "gebayxv.dll" [null data] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "D:\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "d:\7-Zip\7-zip.dll" ["Igor Pavlov"] EditPlus\(Default) = "{63AFBDFB-5EF8-4791-AF79-9A3C0DE48974}" -> {HKLM...CLSID} = "EditPlus Context Menu Handler" \InProcServer32\(Default) = "d:\EditPlus 2\eppshell.dll" [null data] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11d3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] PSPad\(Default) = "{8903F6C9-25E3-40AC-A98F-E6D35CD0469C}" -> {HKLM...CLSID} = "PSPad" \InProcServer32\(Default) = "d:\PSPADE~1\PSPADS~1.DLL" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "d:\7-Zip\7-zip.dll" ["Igor Pavlov"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11d3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\sir_romanek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "sir_romanek" & "All Users" startup folders: ------------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Reader Speed Launch" -> shortcut to: "D:\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] "Net Sentinel" -> shortcut to: "D:\Net Sentinel\NS.exe" [empty string] "Ralink Wireless Utility" -> shortcut to: "C:\Program Files\RALINK\Common\RaUI.exe -s" ["Ralink Technology, Corp."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: imon.dll [null data], 01 - 05, 19 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 18 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] "{74DD705D-6834-439C-A735-A6DBE2677452}" -> {HKLM...CLSID} = "&VSAdd-in" \InProcServer32\(Default) = "C:\Program Files\VSAdd-in\VSAdd-in.dll" [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7}" = "Mario Forever Toolbar" -> {HKLM...CLSID} = "Mario Forever Toolbar" \InProcServer32\(Default) = "C:\Program Files\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll" [null data] "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] "{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet" -> {HKLM...CLSID} = "FlashGet" \InProcServer32\(Default) = "D:\FlashGet\fgiebar.dll" ["Amaze Soft"] "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided) -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\(Default) = "Groove Folder Synchronization" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Poszukaj" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "D:\MICROS~1\Office12\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.5.0_10" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_10" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll" ["Sun Microsystems, Inc."] {2670000A-7350-4F3C-8081-5663EE0C6C49}\ "ButtonText" = "Wyślij do programu OneNote" "MenuText" = "Wyślij &do programu OneNote" "CLSIDExtension" = "{48E73304-E1D6-4330-914C-F5F514E3486C}" -> {HKLM...CLSID} = "Send to OneNote from Internet Explorer button" \InProcServer32\(Default) = "D:\MICROS~1\Office12\ONBttnIE.dll" [MS] {2D663D1A-8670-49D9-A1A5-4C56B4E14E84}\ "ButtonText" = "Spyware Doctor" "CLSIDExtension" = "{A1EDC4A1-940F-48E0-8DFD-E38F1D501021}" -> {HKLM...CLSID} = "PCTools Browser Monitor" \InProcServer32\(Default) = "D:\SPYWAR~1\tools\iesdpb.dll" ["PC Tools"] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Research" {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "FlashGet" "Exec" = "D:\FlashGet\flashget.exe" ["FlashGet.com"] {E2E2DD38-D088-4134-82B7-F2BA38496583}\ "MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] {FD9DE2B4-C926-4460-81C4-FC58C6F1062E}\ "ButtonText" = "SmartWhois" "Exec" = "D:\SmartWhois\swmsie.exe" ["TamoSoft"] {FF983118-58C7-4AD4-B5A7-691C39CB7B42}\ "MenuText" = "SmartWhois" "Exec" = "D:\SmartWhois\swmsie.exe" ["TamoSoft"] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe"" [MS] NOD32 Kernel Service, NOD32krn, "C:\Program Files\Eset\nod32krn.exe" [null data] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] PC Tools Spyware Doctor, SDhelper, "d:\Spyware Doctor\sdhelp.exe" ["PC Tools"] PDScheduler, PDSched, "d:\PerfectDisk\PDSched.exe" ["Raxco Software, Inc."] StarWind iSCSI Service, StarWindService, "d:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] Send To Microsoft OneNote Monitor\Driver = "msonpmon.dll" [MS] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 14 seconds. ---------- (total run time: 110 seconds)

**Posty:** 1134 · przez **MISTEJK** 28 Sty 2007, 19:45

Start --> uruchom --> services.msc --> zatrzymaj i wyłącz usługe:Windows Server Management Services
Otwórz hijackthis --> open misc tools section --> delete a NT service --> wpisz: WSMSPSVC --> ok

Wyłącz przywracanie systemu i wejdź w tryb awaryjny.
Najpierw usuwasz wpisy w Hijackthis, następnie pogrubione pliki ręcznie z dysku:

O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\system32\lugdwcju.dll",setvm
O23 - Service: Windows Server Management Services (WSMSPSVC) - Unknown owner - C:\WINDOWS\navsvc.exe (file missing)

Użyj: SmitfraudFix (z opcji 2 w trybie awaryjnym).
:arrow:

Tutaj jest opis tego narzędzia.

Użyj to:
:arrow:

http://www.majorgeeks.com/download4954.html
:arrow:

http://www.symantec.com/smb/security_response/writeup.jsp?docid=2004-112210-3747-99

Przeskanuj system tym programem i usuń wszystko co znajdzie: www.ewido.net i wklej raport na forum.

Wklej nowe logi z Hijackthis + Silent Runners+ rapotr z ewido

**Posty:** 65 · przez **sir_romanek** 29 Sty 2007, 00:23

Tego nie znalazłem

MISTEJK napisał(a):O23 - Service: Windows Server Management Services (WSMSPSVC) - Unknown owner - C:\WINDOWS\navsvc.exe (file missing)

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 23:04:54, on 2007-01-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\htpatch.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe D:\Microsoft Office\Office12\GrooveMonitor.exe D:\DAEMON Tools\daemon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe D:\Gadu-Gadu\gg.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe C:\Program Files\Eset\nod32krn.exe D:\NetMeter\NetMeter.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\RALINK\Common\RaUI.exe d:\Spyware Doctor\sdhelp.exe d:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\sir_romanek\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O3 - Toolbar: Mario Forever Toolbar - {71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7} - C:\Program Files\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\FlashGet\fgiebar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] d:\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [GrooveMonitor] "D:\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime O4 - HKLM\..\Run: [DAEMON Tools] "d:\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [CloneCDTray] "d:\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\system32\bgtuutmv.dll",setvm O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ProxyWay] D:\ProxyWay\proxyway.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [D:\NetMeter\NetMeter.exe] D:\NetMeter\NetMeter.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Net Sentinel.lnk = D:\Net Sentinel\NS.exe O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - D:\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - D:\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://D:\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\flashget.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: SmartWhois - {FD9DE2B4-C926-4460-81C4-FC58C6F1062E} - D:\SmartWhois\swmsie.exe O9 - Extra button: (no name) - {FF983118-58C7-4AD4-B5A7-691C39CB7B42} - D:\SmartWhois\swmsie.exe O9 - Extra 'Tools' menuitem: SmartWhois - {FF983118-58C7-4AD4-B5A7-691C39CB7B42} - D:\SmartWhois\swmsie.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{8FB017F1-3F52-4D56-B10B-DB6115CEA35A}: NameServer = 194.204.159.1,194.204.152.34 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PDEngine - Raxco Software, Inc. - d:\PerfectDisk\PDEngine.exe O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - d:\PerfectDisk\PDSched.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - d:\Spyware Doctor\sdhelp.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - d:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""D:\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "ProxyWay" = "D:\ProxyWay\proxyway.exe" [file not found] "swg" = "C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe" ["Google Inc."] "D:\NetMeter\NetMeter.exe" = "D:\NetMeter\NetMeter.exe" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "HTpatch" = "C:\WINDOWS\htpatch.exe" [null data] "SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."] "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" [null data] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"" ["Sun Microsystems, Inc."] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}" = "d:\Gmail Notifier\gnotify.exe" ["Google Inc."] "GrooveMonitor" = ""D:\Microsoft Office\Office12\GrooveMonitor.exe"" [MS] "QuickTime Task" = ""C:\WINDOWS\system32\qttask.exe" -atboottime" ["Apple Computer, Inc."] "DAEMON Tools" = ""d:\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "CloneCDTray" = ""d:\SlySoft\CloneCD\CloneCDTray.exe" /s" ["SlySoft, Inc."] "DllRunning" = "rundll32.exe "C:\WINDOWS\system32\bgtuutmv.dll",setvm" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "D:\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Flashget Catch Url Class" \InProcServer32\(Default) = "D:\FlashGet\jccatch.dll" ["www.flashget.com"] {46A4E9D9-B30E-452A-8157-DBBEC8573B03}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\VSAdd-in\VSAdd-in.dll" [file not found] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\(Default) = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}\(Default) = (no title provided) -> {HKLM...CLSID} = "PCTools Site Guard" \InProcServer32\(Default) = "D:\SPYWAR~1\tools\iesdsg.dll" ["PC Tools"] {6A580B57-4F32-4257-BB70-CC14ACB88621}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nnlmk.dll" [null data] {72853161-30C5-4D22-B7F9-0BBC1D38A37E}\(Default) = (no title provided) -> {HKLM...CLSID} = "Groove GFS Browser Helper" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."] {9DB03909-5DA1-4008-A614-E04706AE5470}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\fcyyx.dll" [null data] {A20854FD-DDB5-4931-8F76-D11EA2364D94}\(Default) = (no title provided) -> {HKLM...CLSID} = "Mario Forever Toolbar Helper" \InProcServer32\(Default) = "C:\Program Files\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll" [null data] {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Helper" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] {B56A7D7D-6927-48C8-A975-17DF180C71AC}\(Default) = (no title provided) -> {HKLM...CLSID} = "PCTools Browser Monitor" \InProcServer32\(Default) = "D:\SPYWAR~1\tools\iesdpb.dll" ["PC Tools"] {EF7C999D-43DD-43C3-A25B-2DB1A881664A}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\gebayxv.dll" [null data] {F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided) -> {HKLM...CLSID} = "gFlash Class" \InProcServer32\(Default) = "D:\FlashGet\getflash.dll" [empty string] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{B089FE88-FB52-11d3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "d:\7-Zip\7-zip.dll" ["Igor Pavlov"] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "d:\ALCOHO~2\ALCOHO~1\axshlex.dll" ["Alcohol Soft Development Team"] "{72853161-30C5-4D22-B7F9-0BBC1D38A37E}" = "Groove GFS Browser Helper" -> {HKLM...CLSID} = "Groove GFS Browser Helper" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}" = "Groove GFS Explorer Bar" -> {HKLM...CLSID} = "Groove Folder Synchronization" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{A449600E-1DC6-4232-B948-9BD794D62056}" = "Groove GFS Stub Icon Handler" -> {HKLM...CLSID} = "Groove GFS Stub Icon Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook" -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{6C467336-8281-4E60-8204-430CED96822D}" = "Groove GFS Context Menu Handler" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{387E725D-DC16-4D76-B310-2C93ED4752A0}" = "Groove XML Icon Handler" -> {HKLM...CLSID} = "Groove XML Icon Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{16F3DD56-1AF5-4347-846D-7C10C4192619}" = "Groove Explorer Icon Overlay 3 (GFS Folder)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 3 (GFS Folder)" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" = "Groove Explorer Icon Overlay 2 (GFS Stub)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2 (GFS Stub)" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{99FD978C-D287-4F50-827F-B2C658EDA8E7}" = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{920E6DB1-9907-4370-B3A0-BAFC03D81399}" = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Outlook File Icon Extension" \InProcServer32\(Default) = "D:\MICROS~1\Office12\OLKFSTUB.DLL" [MS] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "D:\MICROS~1\Office12\MLSHEXT.DLL" [MS] "{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" -> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" \InProcServer32\(Default) = "D:\MICROS~1\Office12\ONFILTER.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "D:\Microsoft Office\Office12\msohevi.dll" [MS] "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler" -> {HKLM...CLSID} = "Microsoft Office Metadata Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler" -> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{8903F6C9-25E3-40AC-A98F-E6D35CD0469C}" = "PSPad" -> {HKLM...CLSID} = "PSPad" \InProcServer32\(Default) = "d:\PSPADE~1\PSPADS~1.DLL" [null data] "{63AFBDFB-5EF8-4791-AF79-9A3C0DE48974}" = "EditPlus Context Menu Handler" -> {HKLM...CLSID} = "EditPlus Context Menu Handler" \InProcServer32\(Default) = "d:\EditPlus 2\eppshell.dll" [null data] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "d:\ACE Mega CoDecS Pack\SystemS\RealMedia\rpshell.dll" ["RealNetworks, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook" -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] <<!>> "{EF7C999D-43DD-43C3-A25B-2DB1A881664A}" = "*g" (unwritable string) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\gebayxv.dll" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ <<!>> "BootExecute" = "PDBoot.exe" ["Raxco Software, Inc."]|"autocheck autochk *" HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> Antiwpa\DLLName = "antiwpa.dll" [null data] <<!>> gebayxv\DLLName = "gebayxv.dll" [null data] <<!>> nnlmk\DLLName = "C:\WINDOWS\system32\nnlmk.dll" [null data] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "D:\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "d:\7-Zip\7-zip.dll" ["Igor Pavlov"] EditPlus\(Default) = "{63AFBDFB-5EF8-4791-AF79-9A3C0DE48974}" -> {HKLM...CLSID} = "EditPlus Context Menu Handler" \InProcServer32\(Default) = "d:\EditPlus 2\eppshell.dll" [null data] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11d3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] PSPad\(Default) = "{8903F6C9-25E3-40AC-A98F-E6D35CD0469C}" -> {HKLM...CLSID} = "PSPad" \InProcServer32\(Default) = "d:\PSPADE~1\PSPADS~1.DLL" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "d:\7-Zip\7-zip.dll" ["Igor Pavlov"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11d3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "sir_romanek" & "All Users" startup folders: ------------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Reader Speed Launch" -> shortcut to: "D:\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] "Net Sentinel" -> shortcut to: "D:\Net Sentinel\NS.exe" [empty string] "Ralink Wireless Utility" -> shortcut to: "C:\Program Files\RALINK\Common\RaUI.exe -s" ["Ralink Technology, Corp."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: imon.dll [null data], 01 - 05, 19 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 18 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] "{74DD705D-6834-439C-A735-A6DBE2677452}" -> {HKLM...CLSID} = "&VSAdd-in" \InProcServer32\(Default) = "C:\Program Files\VSAdd-in\VSAdd-in.dll" [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7}" = "Mario Forever Toolbar" -> {HKLM...CLSID} = "Mario Forever Toolbar" \InProcServer32\(Default) = "C:\Program Files\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll" [null data] "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] "{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet" -> {HKLM...CLSID} = "FlashGet" \InProcServer32\(Default) = "D:\FlashGet\fgiebar.dll" ["Amaze Soft"] "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided) -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\(Default) = "Groove Folder Synchronization" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Poszukaj" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "D:\MICROS~1\Office12\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.5.0_10" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_10" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll" ["Sun Microsystems, Inc."] {2670000A-7350-4F3C-8081-5663EE0C6C49}\ "ButtonText" = "Wyślij do programu OneNote" "MenuText" = "Wyślij &do programu OneNote" "CLSIDExtension" = "{48E73304-E1D6-4330-914C-F5F514E3486C}" -> {HKLM...CLSID} = "Send to OneNote from Internet Explorer button" \InProcServer32\(Default) = "D:\MICROS~1\Office12\ONBttnIE.dll" [MS] {2D663D1A-8670-49D9-A1A5-4C56B4E14E84}\ "ButtonText" = "Spyware Doctor" "CLSIDExtension" = "{A1EDC4A1-940F-48E0-8DFD-E38F1D501021}" -> {HKLM...CLSID} = "PCTools Browser Monitor" \InProcServer32\(Default) = "D:\SPYWAR~1\tools\iesdpb.dll" ["PC Tools"] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Research" {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "FlashGet" "Exec" = "D:\FlashGet\flashget.exe" ["FlashGet.com"] {E2E2DD38-D088-4134-82B7-F2BA38496583}\ "MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] {FD9DE2B4-C926-4460-81C4-FC58C6F1062E}\ "ButtonText" = "SmartWhois" "Exec" = "D:\SmartWhois\swmsie.exe" ["TamoSoft"] {FF983118-58C7-4AD4-B5A7-691C39CB7B42}\ "MenuText" = "SmartWhois" "Exec" = "D:\SmartWhois\swmsie.exe" ["TamoSoft"] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe"" [MS] NOD32 Kernel Service, NOD32krn, "C:\Program Files\Eset\nod32krn.exe" [null data] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] PC Tools Spyware Doctor, SDhelper, "d:\Spyware Doctor\sdhelp.exe" ["PC Tools"] StarWind iSCSI Service, StarWindService, "d:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] Send To Microsoft OneNote Monitor\Driver = "msonpmon.dll" [MS] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 85 seconds. ---------- (total run time: 197 seconds)

Kod: Zaznacz wszystko: __________________________________________________ ewido anti-spyware online scanner http://www.ewido.net __________________________________________________ Name: TrackingCookie.Fastclick Path: :mozilla.13:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Fastclick Path: :mozilla.14:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Fastclick Path: :mozilla.15:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Fastclick Path: :mozilla.16:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Fastclick Path: :mozilla.17:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Fastclick Path: :mozilla.18:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Reliablestats Path: :mozilla.38:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Reliablestats Path: :mozilla.39:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Reliablestats Path: :mozilla.40:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Reliablestats Path: :mozilla.41:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Tribalfusion Path: :mozilla.53:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.54:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.55:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.56:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.57:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.58:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.59:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.60:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.61:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Tribalfusion Path: :mozilla.62:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Mediaplex Path: :mozilla.73:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.80:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.81:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.82:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.83:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Doubleclick Path: :mozilla.84:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.85:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.86:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.87:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.88:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Webtrendslive Path: :mozilla.91:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.109:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.110:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.115:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.116:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Com Path: :mozilla.154:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.168:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.172:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.173:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.174:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.175:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.176:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.177:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.178:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Bfast Path: :mozilla.179:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Adbrite Path: :mozilla.183:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Adbrite Path: :mozilla.184:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.240:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.241:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.254:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.255:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.267:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.268:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.269:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.270:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.271:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Valuead Path: :mozilla.282:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Valuead Path: :mozilla.283:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Valuead Path: :mozilla.284:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Valuead Path: :mozilla.285:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Valuead Path: :mozilla.286:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Valuead Path: :mozilla.287:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Valuead Path: :mozilla.288:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Atdmt Path: :mozilla.300:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Enhance Path: :mozilla.332:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Enhance Path: :mozilla.333:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Targetnet Path: :mozilla.363:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Clickbank Path: :mozilla.397:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.431:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Casalemedia Path: :mozilla.437:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Tacoda Path: :mozilla.440:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Tacoda Path: :mozilla.442:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Euroclick Path: :mozilla.460:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Euroclick Path: :mozilla.461:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Goclick Path: :mozilla.475:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Goclick Path: :mozilla.476:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Information Path: :mozilla.477:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Revenue Path: :mozilla.478:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Trafic Path: :mozilla.540:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Adjuggler Path: :mozilla.545:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Burstnet Path: :mozilla.546:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Burstnet Path: :mozilla.547:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Adjuggler Path: :mozilla.548:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Adjuggler Path: :mozilla.549:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Advertising Path: :mozilla.620:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Advertising Path: :mozilla.621:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.661:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.662:C:\Documents and Settings\sir_romanek\Dane aplikacji\Mozilla\Firefox\Profiles\8u8yfn6x.default\cookies.txt Risk: Medium Name: Adware.DriveCleaner Path: C:\Program Files\Common Files\DriveCleaner Free\__delete_on_reboot__u_d_c_p_a_s_._e_x_e_ Risk: Medium Name: Adware.DriveCleaner Path: C:\Program Files\Common Files\DriveCleaner Free\__delete_on_reboot__u_d_c_s_d_r_._e_x_e_ Risk: Medium

ewido skanowałem kilka razy i zawsze pokazuje to samo i nie usuwa.

**Posty:** 95 · przez **destroyeR!** 29 Sty 2007, 01:01

Więc wyłącz przywracanie systemu na wszystkich dyskach, włącz tryb awaryjny z obsługą sieci i przeskanuj jeszcze raz ewido.

**Posty:** 65 · przez **sir_romanek** 29 Sty 2007, 01:46

Hmm teraz jak chcę włączyć tryb awaryjny z obsługą sieci to wyskakuje mi że muszę aktywować windowsa bo minoł 30 dniowy okres próbny

**Posty:** 95 · przez **destroyeR!** 29 Sty 2007, 11:41

No to kołuj nopwego windowsa

Albo poszukaj może da sie to przedłużyć o kolejne 30 dni [;

**Posty:** 65 · przez **sir_romanek** 29 Sty 2007, 13:33

destroyeR! napisał(a):No to kołuj nopwego windowsa Albo poszukaj może da sie to przedłużyć o kolejne 30 dni [;

Długo nad tym myślałeś???

Nie wiem co się stało windowsa mam od ponad roku i jakoś nie jęczał o aktywację zresztą gdybym nie miał go aktywowanego to jak bym mógł teraz pisać, w trybie normalnym uruchamia się bez problemów tylko w trybie awaryjnym z obsługą sieci się nie uruchamia. A zaczęło tak się dziać od momentu kiedy użyłem vundofix gdy ten program zrobił resa to i bios mi się zresetował i musiałem wszystko na nowo ustawiać procka, datę godzinę...

**Posty:** 1134 · przez **MISTEJK** 29 Sty 2007, 16:18

w zwykły tryb wejdz, bez obsługi.

Poza tym kup oryginalna wersję systemu to nie będziesz miał problemów.

**Posty:** 65 · przez **sir_romanek** 29 Sty 2007, 16:34

Widzę że nie otrzymam tu pomocy
ewido w trybie awaryjnym bez sieci nie działa ale to zapewne wiecie

**Posty:** 95 · przez **destroyeR!** 29 Sty 2007, 20:27

Po pierwsze:

Może spróbuj inaczej. Ściągnij ewido na dysk najpierw. Później wejdź w tryb awaryjny i wtedy przeskanuj , bo zapewne skanowałeś ON-LINE. Chyba że tak robiłeś.

Po drugie:

To ty prosisz żebyśmy ci sprawdzili logi i staramy się pomóc więc nie rób łaski ok ?

**Posty:** 65 · przez **sir_romanek** 29 Sty 2007, 22:50

Kod: Zaznacz wszystko: To ty prosisz żebyśmy ci sprawdzili logi i staramy się pomóc więc nie rób łaski ok ?

Wiem racja i przepraszam nieraz człowiek się zapomina.
Nod mi pokazuje coś takiego

Kod: Zaznacz wszystko: Infekcja prawdopodobnie odmiana Win32/TrojanDownloader.ConHook trojan została wykryta w pamięci operacyjnej. Nie można podjąć żadnej akcji do zainfekowanej pamięci. Należy wybrać opcję "pozostaw" i kontynuować proces leczenia wszystkich dysków lokalnych. Pamięć systemu została zainfekowana z pliku C:\WINDOWS\system32\gebayxv.dll.

Prubuję usunąć ten plik:

Kod: Zaznacz wszystko: C:\WINDOWS\system32\gebayxv.dll.

za pomocą killboxa ale albo coś robię źle albo tego pliku nie da się usunąć.

**Posty:** 18165 · przez **wojtas** 29 Sty 2007, 22:53

sciagnij killbox`a:

http://www.wiruskill.pl/forum/viewtopic.php?t=58

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę :

C:\WINDOWS\system32\gebayxv.dll

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

**Posty:** 65 · przez **sir_romanek** 29 Sty 2007, 23:49

Gdy to robię to mam coś takiego w trybie awaryjnym też próbowałem i wyskakuje to samo:

PendingFileRenameOperatons Registry Data has been Removed External Process!

Niestety mnie ruskiego uczyli i nie wiem co to znaczy mam wrażeniw że robię z siebie kompletnego osła:(

**Posty:** 1134 · przez **MISTEJK** 30 Sty 2007, 00:16

nowe logi daj...

+ daj raport z F-secure: http://www.komputery.boo.pl/viewtopic.php?t=19

**Posty:** 65 · przez **sir_romanek** 30 Sty 2007, 00:35

Kod: Zaznacz wszystko: 01/29/07 23:13:42 [Info]: BlackLight Engine 1.0.55 initialized 01/29/07 23:13:42 [Info]: OS: 5.1 build 2600 (Dodatek Service Pack 2) 01/29/07 23:13:42 [Note]: 7019 4 01/29/07 23:13:42 [Note]: 7005 0 01/29/07 23:14:42 [Note]: 7006 0 01/29/07 23:14:42 [Note]: 7011 1252 01/29/07 23:14:42 [Note]: 7026 0 01/29/07 23:14:42 [Note]: 7026 0 01/29/07 23:14:56 [Note]: FSRAW library version 1.7.1021 01/29/07 23:18:09 [Note]: 2000 1012 01/29/07 23:18:22 [Note]: 7007 0

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 23:19:18, on 2007-01-29 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\htpatch.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe D:\Microsoft Office\Office12\GrooveMonitor.exe D:\DAEMON Tools\daemon.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe D:\NetMeter\NetMeter.exe d:\Spyware Doctor\sdhelp.exe C:\Program Files\RALINK\Common\RaUI.exe d:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe d:\PerfectDisk\PDSched.exe C:\WINDOWS\System32\alg.exe d:\ewido anti-spyware 4.0\guard.exe d:\ewido anti-spyware 4.0\ewido.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\sir_romanek\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O3 - Toolbar: Mario Forever Toolbar - {71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7} - C:\Program Files\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\FlashGet\fgiebar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] d:\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [GrooveMonitor] "D:\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime O4 - HKLM\..\Run: [DAEMON Tools] "d:\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [CloneCDTray] "d:\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\system32\bgtuutmv.dll",setvm O4 - HKLM\..\Run: [!ewido] "d:\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ProxyWay] D:\ProxyWay\proxyway.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [D:\NetMeter\NetMeter.exe] D:\NetMeter\NetMeter.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - D:\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - D:\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://D:\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\flashget.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: SmartWhois - {FD9DE2B4-C926-4460-81C4-FC58C6F1062E} - D:\SmartWhois\swmsie.exe O9 - Extra button: (no name) - {FF983118-58C7-4AD4-B5A7-691C39CB7B42} - D:\SmartWhois\swmsie.exe O9 - Extra 'Tools' menuitem: SmartWhois - {FF983118-58C7-4AD4-B5A7-691C39CB7B42} - D:\SmartWhois\swmsie.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1170026140355 O17 - HKLM\System\CCS\Services\Tcpip\..\{8FB017F1-3F52-4D56-B10B-DB6115CEA35A}: NameServer = 194.204.159.1,194.204.152.34 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - d:\ewido anti-spyware 4.0\guard.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PDEngine - Raxco Software, Inc. - d:\PerfectDisk\PDEngine.exe O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - d:\PerfectDisk\PDSched.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - d:\Spyware Doctor\sdhelp.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - d:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""D:\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "ProxyWay" = "D:\ProxyWay\proxyway.exe" [file not found] "swg" = "C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe" ["Google Inc."] "D:\NetMeter\NetMeter.exe" = "D:\NetMeter\NetMeter.exe" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "HTpatch" = "C:\WINDOWS\htpatch.exe" [null data] "SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."] "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"" ["Sun Microsystems, Inc."] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}" = "d:\Gmail Notifier\gnotify.exe" ["Google Inc."] "GrooveMonitor" = ""D:\Microsoft Office\Office12\GrooveMonitor.exe"" [MS] "QuickTime Task" = ""C:\WINDOWS\system32\qttask.exe" -atboottime" ["Apple Computer, Inc."] "DAEMON Tools" = ""d:\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "CloneCDTray" = ""d:\SlySoft\CloneCD\CloneCDTray.exe" /s" ["SlySoft, Inc."] "DllRunning" = "rundll32.exe "C:\WINDOWS\system32\bgtuutmv.dll",setvm" [MS] "!ewido" = ""d:\ewido anti-spyware 4.0\ewido.exe" /minimized" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "D:\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Flashget Catch Url Class" \InProcServer32\(Default) = "D:\FlashGet\jccatch.dll" ["www.flashget.com"] {41C216EC-5823-4DC2-B9BA-3EC3D0411FEA}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nnlmk.dll" [null data] {46A4E9D9-B30E-452A-8157-DBBEC8573B03}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\VSAdd-in\VSAdd-in.dll" [file not found] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\(Default) = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}\(Default) = (no title provided) -> {HKLM...CLSID} = "PCTools Site Guard" \InProcServer32\(Default) = "D:\SPYWAR~1\tools\iesdsg.dll" ["PC Tools"] {72853161-30C5-4D22-B7F9-0BBC1D38A37E}\(Default) = (no title provided) -> {HKLM...CLSID} = "Groove GFS Browser Helper" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."] {9DB03909-5DA1-4008-A614-E04706AE5470}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\fcyyx.dll" [file not found] {A20854FD-DDB5-4931-8F76-D11EA2364D94}\(Default) = (no title provided) -> {HKLM...CLSID} = "Mario Forever Toolbar Helper" \InProcServer32\(Default) = "C:\Program Files\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll" [null data] {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Helper" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] {B56A7D7D-6927-48C8-A975-17DF180C71AC}\(Default) = (no title provided) -> {HKLM...CLSID} = "PCTools Browser Monitor" \InProcServer32\(Default) = "D:\SPYWAR~1\tools\iesdpb.dll" ["PC Tools"] {EF7C999D-43DD-43C3-A25B-2DB1A881664A}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\gebayxv.dll" [null data] {F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided) -> {HKLM...CLSID} = "gFlash Class" \InProcServer32\(Default) = "D:\FlashGet\getflash.dll" [empty string] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{B089FE88-FB52-11d3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "d:\7-Zip\7-zip.dll" ["Igor Pavlov"] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "d:\ALCOHO~2\ALCOHO~1\axshlex.dll" ["Alcohol Soft Development Team"] "{72853161-30C5-4D22-B7F9-0BBC1D38A37E}" = "Groove GFS Browser Helper" -> {HKLM...CLSID} = "Groove GFS Browser Helper" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}" = "Groove GFS Explorer Bar" -> {HKLM...CLSID} = "Groove Folder Synchronization" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{A449600E-1DC6-4232-B948-9BD794D62056}" = "Groove GFS Stub Icon Handler" -> {HKLM...CLSID} = "Groove GFS Stub Icon Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook" -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{6C467336-8281-4E60-8204-430CED96822D}" = "Groove GFS Context Menu Handler" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{387E725D-DC16-4D76-B310-2C93ED4752A0}" = "Groove XML Icon Handler" -> {HKLM...CLSID} = "Groove XML Icon Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{16F3DD56-1AF5-4347-846D-7C10C4192619}" = "Groove Explorer Icon Overlay 3 (GFS Folder)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 3 (GFS Folder)" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" = "Groove Explorer Icon Overlay 2 (GFS Stub)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2 (GFS Stub)" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{99FD978C-D287-4F50-827F-B2C658EDA8E7}" = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{920E6DB1-9907-4370-B3A0-BAFC03D81399}" = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Outlook File Icon Extension" \InProcServer32\(Default) = "D:\MICROS~1\Office12\OLKFSTUB.DLL" [MS] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "D:\MICROS~1\Office12\MLSHEXT.DLL" [MS] "{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" -> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" \InProcServer32\(Default) = "D:\MICROS~1\Office12\ONFILTER.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "D:\Microsoft Office\Office12\msohevi.dll" [MS] "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler" -> {HKLM...CLSID} = "Microsoft Office Metadata Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler" -> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{8903F6C9-25E3-40AC-A98F-E6D35CD0469C}" = "PSPad" -> {HKLM...CLSID} = "PSPad" \InProcServer32\(Default) = "d:\PSPADE~1\PSPADS~1.DLL" [null data] "{63AFBDFB-5EF8-4791-AF79-9A3C0DE48974}" = "EditPlus Context Menu Handler" -> {HKLM...CLSID} = "EditPlus Context Menu Handler" \InProcServer32\(Default) = "d:\EditPlus 2\eppshell.dll" [null data] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "d:\ACE Mega CoDecS Pack\SystemS\RealMedia\rpshell.dll" ["RealNetworks, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook" -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] <<!>> "{EF7C999D-43DD-43C3-A25B-2DB1A881664A}" = "*g" (unwritable string) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\gebayxv.dll" [null data] <<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "d:\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ <<!>> "BootExecute" = "PDBoot.exe" ["Raxco Software, Inc."]|"autocheck autochk *" HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> Antiwpa\DLLName = "antiwpa.dll" [null data] <<!>> gebayxv\DLLName = "gebayxv.dll" [null data] <<!>> nnlmk\DLLName = "C:\WINDOWS\system32\nnlmk.dll" [null data] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "D:\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "d:\7-Zip\7-zip.dll" ["Igor Pavlov"] EditPlus\(Default) = "{63AFBDFB-5EF8-4791-AF79-9A3C0DE48974}" -> {HKLM...CLSID} = "EditPlus Context Menu Handler" \InProcServer32\(Default) = "d:\EditPlus 2\eppshell.dll" [null data] ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "d:\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] PSPad\(Default) = "{8903F6C9-25E3-40AC-A98F-E6D35CD0469C}" -> {HKLM...CLSID} = "PSPad" \InProcServer32\(Default) = "d:\PSPADE~1\PSPADS~1.DLL" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "d:\7-Zip\7-zip.dll" ["Igor Pavlov"] ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "d:\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "DisableRegistryTools" = (REG_DWORD) hex:0x00000000 {Prevent access to registry editing tools} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\sir_romanek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "sir_romanek" & "All Users" startup folders: ------------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Reader Speed Launch" -> shortcut to: "D:\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] "Ralink Wireless Utility" -> shortcut to: "C:\Program Files\RALINK\Common\RaUI.exe -s" ["Ralink Technology, Corp."] Enabled Scheduled Tasks: ------------------------ "At1" -> launches: "C:\DOCUME~1\SIR_RO~1\Pulpit\Look2Me-Destroyer.exe /task" ["Atribune.org"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: imon.dll ["Eset "], 01 - 05, 19 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 18 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] "{74DD705D-6834-439C-A735-A6DBE2677452}" -> {HKLM...CLSID} = "&VSAdd-in" \InProcServer32\(Default) = "C:\Program Files\VSAdd-in\VSAdd-in.dll" [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7}" = "Mario Forever Toolbar" -> {HKLM...CLSID} = "Mario Forever Toolbar" \InProcServer32\(Default) = "C:\Program Files\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll" [null data] "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] "{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet" -> {HKLM...CLSID} = "FlashGet" \InProcServer32\(Default) = "D:\FlashGet\fgiebar.dll" ["Amaze Soft"] "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided) -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\(Default) = "Groove Folder Synchronization" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "D:\MICROS~1\Office12\GRA8E1~1.DLL" [MS] HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Poszukaj" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "D:\MICROS~1\Office12\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.5.0_10" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_10" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll" ["Sun Microsystems, Inc."] {2670000A-7350-4F3C-8081-5663EE0C6C49}\ "ButtonText" = "Wyślij do programu OneNote" "MenuText" = "Wyślij &do programu OneNote" "CLSIDExtension" = "{48E73304-E1D6-4330-914C-F5F514E3486C}" -> {HKLM...CLSID} = "Send to OneNote from Internet Explorer button" \InProcServer32\(Default) = "D:\MICROS~1\Office12\ONBttnIE.dll" [MS] {2D663D1A-8670-49D9-A1A5-4C56B4E14E84}\ "ButtonText" = "Spyware Doctor" "CLSIDExtension" = "{A1EDC4A1-940F-48E0-8DFD-E38F1D501021}" -> {HKLM...CLSID} = "PCTools Browser Monitor" \InProcServer32\(Default) = "D:\SPYWAR~1\tools\iesdpb.dll" ["PC Tools"] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Research" {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "FlashGet" "Exec" = "D:\FlashGet\flashget.exe" ["FlashGet.com"] {E2E2DD38-D088-4134-82B7-F2BA38496583}\ "MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] {FD9DE2B4-C926-4460-81C4-FC58C6F1062E}\ "ButtonText" = "SmartWhois" "Exec" = "D:\SmartWhois\swmsie.exe" ["TamoSoft"] {FF983118-58C7-4AD4-B5A7-691C39CB7B42}\ "MenuText" = "SmartWhois" "Exec" = "D:\SmartWhois\swmsie.exe" ["TamoSoft"] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "d:\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."] Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe"" [MS] NOD32 Kernel Service, NOD32krn, "C:\Program Files\Eset\nod32krn.exe" ["Eset "] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] PC Tools Spyware Doctor, SDhelper, "d:\Spyware Doctor\sdhelp.exe" ["PC Tools"] PDScheduler, PDSched, "d:\PerfectDisk\PDSched.exe" ["Raxco Software, Inc."] StarWind iSCSI Service, StarWindService, "d:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] Send To Microsoft OneNote Monitor\Driver = "msonpmon.dll" [MS] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 110 seconds. ---------- (total run time: 188 seconds)

**Posty:** 1134 · przez **MISTEJK** 30 Sty 2007, 09:46

Użyj WWDC :

http://www.firewallleaktester.com/wwdc.htm

Zmień opcje z disable na enable. Zresetuj komputer.

Foto przedtawia prawidłowe ustawienie portów :

http://www.firewallleaktester.com/images_site/wwdc.jpg

http://www.downloads.subratam.org/KillBox.zip
Zaznaczasz Delete on reboot, w polu full path of file wklej ścieżki plików i klikasz na czerwony krzyżyk:

C:\WINDOWS\system32\nnlmk.dll
C:\WINDOWS\system32\fcyyx.dll
C:\WINDOWS\system32\gebayxv.dll
C:\WINDOWS\system32\bgtuutmv.dll

Otwórz Notatnik i wklej w nim to :

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41C216EC-5823-4DC2-B9BA-3EC3D0411FEA}]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{46A4E9D9-B30E-452A-8157-DBBEC8573B03}]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9DB03909-5DA1-4008-A614-E04706AE5470}]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF7C999D-43DD-43C3-A25B-2DB1A881664A}]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{EF7C999D-43DD-43C3-A25B-2DB1A881664A}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
"BootExecute"=hex(7):61,00,75,00,74,00,6f,00,63,00,68,00,65,00,63,00,6b,00,20,\
00,61,00,75,00,74,00,6f,00,63,00,68,00,6b,00,20,00,2a,00,00,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"gebayxv.dll"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{74DD705D-6834-439C-A735-A6DBE2677452}"=-

Następnie - Plik -> Zapisz jako .... -> zmień rozszerzenie z *.txt na *.* Wszystkie pliki -> nazwa FIX.REG. Uruchamiasz ten plik w trybie awaryjny.

W hijackthis kasujesz:

O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\WINDOWS\system32\bgtuutmv.dll",setvm

i dajesz nowe logi.

**Posty:** 65 · przez **sir_romanek** 30 Sty 2007, 12:31

Jak próbuję wykasować te pliki killboxem to pokazuje mi się taki text:

PendingFileRenameOperatons Registry Data has been Removed External Process!

Kod: Zaznacz wszystko: __________________________________________________ Pocket Killbox version 2.0.0.648 Running on Windows XP as sir_romanek(Administrator) was started @ wtorek, styczeń 30, 2007, 11:17 AM # 1 [Delete on Reboot] Path = C:\WINDOWS\system32\nnlmk.dll PendingFileRenameOperations Registry Data has been Removed by External Process! @ 11:18:12 AM # 2 [Delete on Reboot] Path = C:\WINDOWS\system32\fcyyx.dll PendingFileRenameOperations Registry Data has been Removed by External Process! @ 11:18:59 AM # 3 [Delete on Reboot] Path = C:\WINDOWS\system32\bgtuutmv.dll PendingFileRenameOperations Registry Data has been Removed by External Process! @ 11:19:20 AM # 4 [Delete on Reboot] Path = C:\WINDOWS\system32\nnlmk.dll PendingFileRenameOperations Registry Data has been Removed by External Process! @ 11:19:48 AM # 5 [Delete on Reboot] Path = C:\WINDOWS\system32\nnlmk.dll PendingFileRenameOperations Registry Data has been Removed by External Process! @ 11:20:10 AM Killbox Closed(Exit) @ 11:21:40 AM __________________________________________________

**Posty:** 8694 · przez **Red** 30 Sty 2007, 12:42

MISTEJK napisał(a):Zaznaczasz Delete on reboot

dodatkowo zaznacz opcje all files
i daj nowe logi do sprawdzenia.

proszę o sprawdzenie logu

Proszę o sprawdzenie logu

Kto jest na forum