proszę o sprawdzenie

**Posty:** 18 · przez **basiag** 01 Lut 2007, 13:22

bardzo prosze o sprawdzenie loga ze Spyware Doctor, nie wiem, co z tym dalej zrobic? jesli sprawdzane sa tylko logi z hijack this to prosze o informacje, z gory bardzo dziekuje
[quote]Spyware Doctor ReportSpyware Doctor Activity Report
Generated on 2007-02-01 11:26:07Spyware Doctor HomepagePC
Tools HomepageTechnical Support

Scans (basic information only):

Scan Results:
scan start:2007-02-01 11:28:23
scan stop:2007-02-01 11:43:08
scanned items:98675
found items:256
found and ignored:0
tools used:General Scanner, Process Scanner, LSP
Scanner, Startup Scanner, Registry Scanner,
Hosts Scanner, Browser Scanner, Browser Activity
Scanner, Disk Scanner, ActiveX Scanner

Infection NameLocationRisk
AdvertisingC:\Documents and
Settings\PC\Cookies\pc@com[1].txtLow
Tracking Cookie(s)C:\Documents and
Settings\PC\Cookies\pc@hit.gemius[2].txtLow
Backdoor.Agent.AIRC:\Program Files\ESETHigh
Backdoor.Agent.AIRC:\Program Files\ESET\cacheHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\CACHE.NDBHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND0.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND1.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND10.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND11.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND12.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND13.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND14.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND15.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND16.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND17.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND18.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND19.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND1A.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND1B.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND1C.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND1D.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND2.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND24.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND25.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND26.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND27.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND28.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND29.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND2A.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND2B.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND2C.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND2D.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND2E.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND2F.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND3.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND30.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND31.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND32.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND33.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND34.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND35.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND36.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND37.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND38.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND39.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND3A.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND3B.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND3C.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND3D.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND3E.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND3F.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND4.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND40.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND41.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND42.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND43.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND5.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND6.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND7.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND8.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FND9.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FNDA.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FNDB.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FNDC.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FNDD.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FNDE.NFIHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\cache\FNDF.NFIHigh
Backdoor.Agent.AIRC:\Program Files\ESET\dmon.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\emon.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\eset.chmHigh
Backdoor.Agent.AIRC:\Program Files\ESET\InstallHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Install\advheur.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Install\archs.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Install\charon.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Install\engine.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Install\main.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Install\mainlang.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Install\mfc42.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Install\mfc42u.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Install\msvcrt.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Install\ntbasepl.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Install\ntinetpl.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Install\ntstdpl.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Install\pwscan.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Install\readme.txtHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Install\setup.exeHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Install\setup.xmlHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Install\utilmod.nupHigh
Backdoor.Agent.AIRC:\Program Files\ESET\logsHigh
Backdoor.Agent.AIRC:\Program Files\ESET\logs\nod32High
Backdoor.Agent.AIRC:\Program
Files\ESET\logs\nod32\NDL29061.DATHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\logs\virlog.datHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\logs\warnlog.datHigh
Backdoor.Agent.AIRC:\Program Files\ESET\nod.ovlHigh
Backdoor.Agent.AIRC:\Program Files\ESET\nod32.000High
Backdoor.Agent.AIRC:\Program Files\ESET\nod32.002High
Backdoor.Agent.AIRC:\Program Files\ESET\nod32.003High
Backdoor.Agent.AIRC:\Program Files\ESET\nod32.004High
Backdoor.Agent.AIRC:\Program Files\ESET\nod32.005High
Backdoor.Agent.AIRC:\Program Files\ESET\nod32.006High
Backdoor.Agent.AIRC:\Program Files\ESET\nod32.chmHigh
Backdoor.Agent.AIRC:\Program Files\ESET\nod32.exeHigh
Backdoor.Agent.AIRC:\Program Files\ESET\nod32.logHigh
Backdoor.Agent.AIRC:\Program Files\ESET\nod32api.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\nod32ari.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\nod32aui.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\nod32fix.regHigh
Backdoor.Agent.AIRC:\Program Files\ESET\nod32krn.exeHigh
Backdoor.Agent.AIRC:\Program Files\ESET\nod32krr.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\nod32kui.chmHigh
Backdoor.Agent.AIRC:\Program Files\ESET\nod32kui.exeHigh
Backdoor.Agent.AIRC:\Program Files\ESET\nod32r.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\nod32rui.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\nodshex.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\nodshex64.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\pr_amon.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\pr_dmon.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\pr_emon.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\pr_imon.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\pr_nod32.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\pr_upd.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\ps_amon.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\ps_amon64.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\ps_dmon.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\ps_emon.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\ps_nod32.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\ps_upd.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\pu_amon.chmHigh
Backdoor.Agent.AIRC:\Program Files\ESET\pu_amon.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\pu_dmon.chmHigh
Backdoor.Agent.AIRC:\Program Files\ESET\pu_dmon.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\pu_emon.chmHigh
Backdoor.Agent.AIRC:\Program Files\ESET\pu_emon.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\pu_imon.chmHigh
Backdoor.Agent.AIRC:\Program Files\ESET\pu_imon.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\pu_nod32.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\pu_upd.chmHigh
Backdoor.Agent.AIRC:\Program Files\ESET\pu_upd.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\readme.txtHigh
Backdoor.Agent.AIRC:\Program Files\ESET\SetupHigh
Backdoor.Agent.AIRC:\Program Files\ESET\Setup\00High
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\00\krnstp.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\00\krnstpr.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\00\krnvis.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\00\pr_upd.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\00\ps_upd.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\00\pu_upd.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\Setup\01High
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\01\ps_amon.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\01\ps_dmon.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\01\ps_nod32.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\01\pu_amon.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\01\pu_dmon.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\01\pu_nod32.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\Setup\02High
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\02\imon.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\02\pr_emon.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\02\pr_imon.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\02\ps_emon.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\02\pu_emon.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\02\pu_imon.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\main.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\mainlang.dllHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\setup.exeHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\Setup\uninst.xmlHigh
Backdoor.Agent.AIRC:\Program Files\ESET\sporder.dllHigh
Backdoor.Agent.AIRC:\Program Files\ESET\unins000.datHigh
Backdoor.Agent.AIRC:\Program Files\ESET\unins000.exeHigh
Backdoor.Agent.AIRC:\Program Files\ESET\updfilesHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\updfiles\lastupd.verHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\updfiles\nod0967.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\updfiles\nod0F4A.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\updfiles\nod1036.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\updfiles\nod10F1.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\updfiles\nod16D7.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\updfiles\nod2685.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\updfiles\nod2767.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\updfiles\nod296C.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\updfiles\nod2D9F.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\updfiles\nod349B.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\updfiles\nod40FB.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\updfiles\nod461C.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\updfiles\nod6821.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\updfiles\nod6AF7.nupHigh
Backdoor.Agent.AIRC:\Program
Files\ESET\updfiles\upd.verHigh
Tracking Cookie(s)cookies.txt - Line #117Low
Tracking Cookie(s)cookies.txt - Line #118Low
Tracking Cookie(s)cookies.txt - Line #119Low
Tracking Cookie(s)cookies.txt - Line #127Low
Tracking Cookie(s)cookies.txt - Line #132Low
Tracking Cookie(s)cookies.txt - Line #133Low
Tracking Cookie(s)cookies.txt - Line #134Low
Tracking Cookie(s)cookies.txt - Line #225Low
Tracking Cookie(s)cookies.txt - Line #226Low
Tracking Cookie(s)cookies.txt - Line #227Low
Advertisingcookies.txt - Line #229Low
Tracking Cookie(s)cookies.txt - Line #253Low
Advertisingcookies.txt - Line #296Low
Tracking Cookie(s)cookies.txt - Line #333Low
Tracking Cookie(s)cookies.txt - Line #336Low
Tracking Cookie(s)cookies.txt - Line #39Low
Advertisingcookies.txt - Line #42Low
Advertisingcookies.txt - Line #422Low
Advertisingcookies.txt - Line #53Low
Known Bad Sitescookies.txt - Line #82High
Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}High
Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}##High
Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Implemented
CategoriesHigh
Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Implemented
Categories##High
Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Implemented
Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}High
Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Implemented
Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}##High
Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\InprocServer32High
Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\InprocServer32##High
Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\InprocServer32##ThreadingModelHigh
Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\ProgIDHigh
Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\ProgID##High
Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\ProgrammableHigh
Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Programmable##High
Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\TypeLibHigh
Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\TypeLib##High
Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\VersionIndependentProgIDHigh
Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\VersionIndependentProgID##High
Backdoor.Agent.AIRHKCR\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}High
Backdoor.Agent.AIRHKCR\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}##High
Backdoor.Agent.AIRHKCR\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32High
Backdoor.Agent.AIRHKCR\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32##High
Backdoor.Agent.AIRHKCR\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32##ThreadingModelHigh
cenzura-spam
DialerHKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Domains\1987324.comHigh
cenzura-spam
DialerHKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Domains\1987324.com##High
cenzura-spam
DialerHKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Domains\1987324.com##*High
cenzura-spam
DialerHKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Domains\1987324.com\wwwHigh
cenzura-spam
DialerHKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Domains\1987324.com\www##High
cenzura-spam
DialerHKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Domains\1987324.com\www##*High
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}High
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}##High
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Implemented
CategoriesHigh
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Implemented
Categories##High
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Implemented
Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}High
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Implemented
Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}##High
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\InprocServer32High
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\InprocServer32##High
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\InprocServer32##ThreadingModelHigh
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\ProgIDHigh
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\ProgID##High
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\ProgrammableHigh
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Programmable##High
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\TypeLibHigh
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\TypeLib##High
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\VersionIndependentProgIDHigh
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\VersionIndependentProgID##High
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}High
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}##High
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32High
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32##High
Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32##ThreadingModelHigh
Backdoor.Agent.AIRHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell
Extensions\Approved##{B089FE88-FB52-11D3-BDF1-0050DA34150D}High

Other Sections:

Copyright © 2003 PC Tools. All rights reserved.Legal Notice

sigs

Click to go back

[/quote]

**Posty:** 1850 · przez **Tomaszu** 01 Lut 2007, 13:26

Opisz dlaczego wrzucasz loga :idea:

Jeśli podejrzewasz jakieś trojany to daj loga z HijackThis i SilentRunners
http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

**Posty:** 18 · przez **basiag** 01 Lut 2007, 16:26

Proszę o sprawdzenie, bo podejrzewam jakieś malware, ale się kompletnie na tym nie znam. spyware doctor wyrzucil duzo rzeczy z priorytetem high które z tego co zrozumialam mogly dokonac "hijack attempt" i dlatego jestem zaniepokojona

log z hijackthis:

[quote]Logfile of HijackThis v1.99.1
Scan saved at 14:50:35, on 2007-02-01
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\IZArc\IZArc.exe
C:\DOCUME~1\PIERNI~1\USTAWI~1\Temp\ARC1BA\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mozilla-europe.org/pl/products/firefox/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED799B32-DCB8-41D8-A7F5-1F1632D692E1}: NameServer = 10.0.0.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe[/quote]

log z silentrunners

[quote]"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"" ["Nero AG"]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."]
"WebCamRT.exe" = "(empty string)" [file not found]
"eMuleAutoStart" = "C:\Program Files\eMule\emule.exe -AutoStart" ["http://www.emule-project.net"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RunDLL32.exe NvMCTray.dll,NvTaskbarInit" [MS]
"RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."]
"SkyTel" = "SkyTel.EXE" ["Realtek Semiconductor Corp."]
"Alcmtr" = "ALCMTR.EXE" ["Realtek Semiconductor Corp."]
"nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "]
"NWEReboot" = "(empty string)" [file not found]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"Lexmark X1100 Series" = ""C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"" ["Lexmark International, Inc."]
"BluetoothAuthenticationAgent" = "rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent" [MS]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}" = "C:\Program Files\Google\Gmail Notifier\gnotify.exe" ["Google Inc."]
"RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."]
"FaxCenterServer" = ""C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{22BF413B-C6D2-4d91-82A9-A0F997BA588C}\(Default) = "Skype add-on (mastermind)"
-> {HKLM...CLSID} = "Skype add-on (mastermind)"
\InProcServer32\(Default) = "C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL" ["Skype Technologies S.A."]
{AE7CD045-E861-484f-8273-0445EE161910}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEToolbarHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
"{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler"
-> {HKLM...CLSID} = "NeroDigitalIconHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"]
"{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler"
-> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
-> {HKLM...CLSID} = "Microsoft Office Outlook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" = "Adobe.Acrobat.ContextMenu"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
"{8FF88D21-7BD0-11D1-BFB7-00AA00262A11}" = "WinAce Archiver 2.6b5 (beta test) Context Menu Shell Extension"
-> {HKLM...CLSID} = "WinAceContext Menu Extension"
\InProcServer32\(Default) = "C:\Program Files\WinAce\arcext.dll" ["e-merge GmbH"]
"{8FF88D25-7BD0-11D1-BFB7-00AA00262A11}" = "WinAce Archiver 2.6b5 (beta test) DragDrop Shell Extension"
-> {HKLM...CLSID} = "WinAceDrag-Drop Extension"
\InProcServer32\(Default) = "C:\Program Files\WinAce\arcext.dll" ["e-merge GmbH"]
"{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}" = "WinAce Archiver 2.6b5 (beta test) Context Menu Shell Extension"
-> {HKLM...CLSID} = "WinAceContext Menu (Add) Extension"
\InProcServer32\(Default) = "C:\Program Files\WinAce\arcext.dll" ["e-merge GmbH"]
"{8FF88D23-7BD0-11D1-BFB7-00AA00262A11}" = "WinAce Archiver 2.6b5 (beta test) Property Sheet Shell Extension"
-> {HKLM...CLSID} = "WinAceProperty Sheet Extension"
\InProcServer32\(Default) = "C:\Program Files\WinAce\arcext.dll" ["e-merge GmbH"]
"{CA5FEE26-14C1-4B5A-86E9-233FC0EE2682}" = "IZArc DragDrop Menu"
-> {HKLM...CLSID} = "IZArc DragDrop Menu"
\InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data]
"{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}" = "IZArc Shell Context Menu"
-> {HKLM...CLSID} = "IZArc Shell Context Menu"
\InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data]

HKLM\Software\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler"
-> {HKLM...CLSID} = "NeroDigitalColumnHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
IZArcCM\(Default) = "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}"
-> {HKLM...CLSID} = "IZArc Shell Context Menu"
\InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data]
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
ZFAdd\(Default) = "{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}"
-> {HKLM...CLSID} = "WinAceContext Menu (Add) Extension"
\InProcServer32\(Default) = "C:\Program Files\WinAce\arcext.dll" ["e-merge GmbH"]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
IZArcCM\(Default) = "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}"
-> {HKLM...CLSID} = "IZArc Shell Context Menu"
\InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data]
ZFAdd\(Default) = "{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}"
-> {HKLM...CLSID} = "WinAceContext Menu (Add) Extension"
\InProcServer32\(Default) = "C:\Program Files\WinAce\arcext.dll" ["e-merge GmbH"]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
FineReader8\(Default) = "{F7091C74-EBB1-49D7-94C7-FE4886CCC18D}"
-> {HKLM...CLSID} = "FineReader8ExplorerContextMenuHandler"
\InProcServer32\(Default) = "C:\Program Files\ABBYY FineReader 8.0 Professional Edition\FECMenu.dll" ["ABBYY Software"]
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]

Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}

Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\PC\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Startup items in "PC" & "All Users" startup folders:
------------------------------------------------------------

C:\Documents and Settings\PC\Menu Start\Programy\Autostart
"SpeedFan" -> shortcut to: "C:\Program Files\SpeedFan\speedfan.exe" ["Almico Software (www.almico.com)"]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"Acrobat Assistant" -> shortcut to: "C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe" ["Adobe Systems Inc."]
"Adobe Gamma Loader" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]
"Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]
"BlueSoleil" -> shortcut to: "C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe" ["IVT Corporation"]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000004\LibraryPath = "%SystemRoot%\system32\wshbth.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 12
%SystemRoot%\system32\mswsock.dll [MS], 06 - 09, 13 - 23
%SystemRoot%\system32\rsvpsp.dll [MS], 10 - 11

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}"
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll" [null data]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll" [null data]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{182EC0BE-5110-49C8-A062-BEB1D02A220B}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll" [null data]

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{77BF5300-1474-4EC7-9980-D32B190E9B07}\
"ButtonText" = "Skype"
"CLSIDExtension" = "{77BF5300-1474-4EC7-9980-D32B190E9B07}"
-> {HKLM...CLSID} = "Skype add-on (button)"
\InProcServer32\(Default) = "C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL" ["Skype Technologies S.A."]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Badanie"

{CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

BlueSoleil Hid Service, BlueSoleil Hid Service, "C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe" [null data]
Bluetooth Support Service, BthServ, "C:\WINDOWS\system32\svchost.exe -k bthsvcs" {"C:\WINDOWS\System32\bthserv.dll" [MS]}
ForceWare IP service, nSvcIp, "C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe" ["NVIDIA Corporation"]
ForceWare user log service, nSvcLog, "C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe" ["NVIDIA Corporation"]
Forceware Web Interface, ForcewareWebInterface, ""C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice" ["Apache Software Foundation"]
LexBce Server, LexBceS, "C:\WINDOWS\system32\LEXBCES.EXE" ["Lexmark International, Inc."]
NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
Adobe PDF Port\Driver = "C:\WINDOWS\system32\AdobePDF.dll" ["Adobe Systems Incorporated."]
Lexmark Network Port\Driver = "LEXLMPM.DLL" ["Lexmark International, Inc."]
Lexmark Print-2-Fax Port\Driver = "LXPRMON.DLL" [null data]
Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]

----------
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 38 seconds.
---------- (total run time: 90 seconds)[/quote]

**Posty:** 1134 · przez **MISTEJK** 01 Lut 2007, 19:43

logi obejmij w tagi

**Posty:** 18 · przez **basiag** 03 Lut 2007, 00:47

log z hijackthis:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 14:50:35, on 2007-02-01 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\WINDOWS\Explorer.EXE C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\WINDOWS\system32\RunDLL32.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Program Files\SpeedFan\speedfan.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\IZArc\IZArc.exe C:\DOCUME~1\PIERNI~1\USTAWI~1\Temp\ARC1BA\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mozilla-europe.org/pl/products/firefox/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{ED799B32-DCB8-41D8-A7F5-1F1632D692E1}: NameServer = 10.0.0.2 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing) O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

log z silentrunners

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"" ["Nero AG"] "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] "Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."] "WebCamRT.exe" = "(empty string)" [file not found] "eMuleAutoStart" = "C:\Program Files\eMule\emule.exe -AutoStart" ["http://www.emule-project.net"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RunDLL32.exe NvMCTray.dll,NvTaskbarInit" [MS] "RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."] "SkyTel" = "SkyTel.EXE" ["Realtek Semiconductor Corp."] "Alcmtr" = "ALCMTR.EXE" ["Realtek Semiconductor Corp."] "nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "] "NWEReboot" = "(empty string)" [file not found] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "Lexmark X1100 Series" = ""C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"" ["Lexmark International, Inc."] "BluetoothAuthenticationAgent" = "rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent" [MS] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}" = "C:\Program Files\Google\Gmail Notifier\gnotify.exe" ["Google Inc."] "RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."] "FaxCenterServer" = ""C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {22BF413B-C6D2-4d91-82A9-A0F997BA588C}\(Default) = "Skype add-on (mastermind)" -> {HKLM...CLSID} = "Skype add-on (mastermind)" \InProcServer32\(Default) = "C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL" ["Skype Technologies S.A."] {AE7CD045-E861-484f-8273-0445EE161910}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEToolbarHelper Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" = "Adobe.Acrobat.ContextMenu" -> {HKLM...CLSID} = "Acrobat Elements Context Menu" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."] "{8FF88D21-7BD0-11D1-BFB7-00AA00262A11}" = "WinAce Archiver 2.6b5 (beta test) Context Menu Shell Extension" -> {HKLM...CLSID} = "WinAceContext Menu Extension" \InProcServer32\(Default) = "C:\Program Files\WinAce\arcext.dll" ["e-merge GmbH"] "{8FF88D25-7BD0-11D1-BFB7-00AA00262A11}" = "WinAce Archiver 2.6b5 (beta test) DragDrop Shell Extension" -> {HKLM...CLSID} = "WinAceDrag-Drop Extension" \InProcServer32\(Default) = "C:\Program Files\WinAce\arcext.dll" ["e-merge GmbH"] "{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}" = "WinAce Archiver 2.6b5 (beta test) Context Menu Shell Extension" -> {HKLM...CLSID} = "WinAceContext Menu (Add) Extension" \InProcServer32\(Default) = "C:\Program Files\WinAce\arcext.dll" ["e-merge GmbH"] "{8FF88D23-7BD0-11D1-BFB7-00AA00262A11}" = "WinAce Archiver 2.6b5 (beta test) Property Sheet Shell Extension" -> {HKLM...CLSID} = "WinAceProperty Sheet Extension" \InProcServer32\(Default) = "C:\Program Files\WinAce\arcext.dll" ["e-merge GmbH"] "{CA5FEE26-14C1-4B5A-86E9-233FC0EE2682}" = "IZArc DragDrop Menu" -> {HKLM...CLSID} = "IZArc DragDrop Menu" \InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data] "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}" = "IZArc Shell Context Menu" -> {HKLM...CLSID} = "IZArc Shell Context Menu" \InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" -> {HKLM...CLSID} = "Acrobat Elements Context Menu" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."] IZArcCM\(Default) = "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}" -> {HKLM...CLSID} = "IZArc Shell Context Menu" \InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] ZFAdd\(Default) = "{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}" -> {HKLM...CLSID} = "WinAceContext Menu (Add) Extension" \InProcServer32\(Default) = "C:\Program Files\WinAce\arcext.dll" ["e-merge GmbH"] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ IZArcCM\(Default) = "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}" -> {HKLM...CLSID} = "IZArc Shell Context Menu" \InProcServer32\(Default) = "C:\PROGRA~1\IZArc\IZArcCM.dll" [null data] ZFAdd\(Default) = "{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}" -> {HKLM...CLSID} = "WinAceContext Menu (Add) Extension" \InProcServer32\(Default) = "C:\Program Files\WinAce\arcext.dll" ["e-merge GmbH"] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ FineReader8\(Default) = "{F7091C74-EBB1-49D7-94C7-FE4886CCC18D}" -> {HKLM...CLSID} = "FineReader8ExplorerContextMenuHandler" \InProcServer32\(Default) = "C:\Program Files\ABBYY FineReader 8.0 Professional Edition\FECMenu.dll" ["ABBYY Software"] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\PC\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "PC" & "All Users" startup folders: ------------------------------------------------------------ C:\Documents and Settings\PC\Menu Start\Programy\Autostart "SpeedFan" -> shortcut to: "C:\Program Files\SpeedFan\speedfan.exe" ["Almico Software (www.almico.com)"] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Acrobat Assistant" -> shortcut to: "C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe" ["Adobe Systems Inc."] "Adobe Gamma Loader" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] "Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] "BlueSoleil" -> shortcut to: "C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe" ["IVT Corporation"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000004\LibraryPath = "%SystemRoot%\system32\wshbth.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 12 %SystemRoot%\system32\mswsock.dll [MS], 06 - 09, 13 - 23 %SystemRoot%\system32\rsvpsp.dll [MS], 10 - 11 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" -> {HKLM...CLSID} = "Adobe PDF" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll" [null data] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = (no title provided) -> {HKLM...CLSID} = "Adobe PDF" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll" [null data] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ {182EC0BE-5110-49C8-A062-BEB1D02A220B}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll" [null data] HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {77BF5300-1474-4EC7-9980-D32B190E9B07}\ "ButtonText" = "Skype" "CLSIDExtension" = "{77BF5300-1474-4EC7-9980-D32B190E9B07}" -> {HKLM...CLSID} = "Skype add-on (button)" \InProcServer32\(Default) = "C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL" ["Skype Technologies S.A."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\ {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ BlueSoleil Hid Service, BlueSoleil Hid Service, "C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe" [null data] Bluetooth Support Service, BthServ, "C:\WINDOWS\system32\svchost.exe -k bthsvcs" {"C:\WINDOWS\System32\bthserv.dll" [MS]} ForceWare IP service, nSvcIp, "C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe" ["NVIDIA Corporation"] ForceWare user log service, nSvcLog, "C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe" ["NVIDIA Corporation"] Forceware Web Interface, ForcewareWebInterface, ""C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice" ["Apache Software Foundation"] LexBce Server, LexBceS, "C:\WINDOWS\system32\LEXBCES.EXE" ["Lexmark International, Inc."] NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Adobe PDF Port\Driver = "C:\WINDOWS\system32\AdobePDF.dll" ["Adobe Systems Incorporated."] Lexmark Network Port\Driver = "LEXLMPM.DLL" ["Lexmark International, Inc."] Lexmark Print-2-Fax Port\Driver = "LXPRMON.DLL" [null data] Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 38 seconds. ---------- (total run time: 90 seconds)

oraz wyniki ze spyware doctor, które jak mówiłam sprawiły, że się zaniepokoiłam:

Kod: Zaznacz wszystko: Spyware Doctor ReportSpyware Doctor Activity Report Generated on 2007-02-01 11:26:07Spyware Doctor HomepagePC Tools HomepageTechnical Support Scans (basic information only): Scan Results: scan start:2007-02-01 11:28:23 scan stop:2007-02-01 11:43:08 scanned items:98675 found items:256 found and ignored:0 tools used:General Scanner, Process Scanner, LSP Scanner, Startup Scanner, Registry Scanner, Hosts Scanner, Browser Scanner, Browser Activity Scanner, Disk Scanner, ActiveX Scanner Infection NameLocationRisk AdvertisingC:\Documents and Settings\PC\Cookies\pc@com[1].txt Low Tracking Cookie(s)C:\Documents and Settings\PC\Cookies\pc@hit.gemius[2].txt Low Backdoor.Agent.AIRC:\Program Files\ESET High Backdoor.Agent.AIRC:\Program Files\ESET\cache High Backdoor.Agent.AIRC:\Program Files\ESET\cache\CACHE.NDB High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND0.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND1.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND10.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND11.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND12.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND13.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND14.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND15.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND16.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND17.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND18.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND19.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND1A.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND1B.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND1C.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND1D.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND2.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND24.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND25.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND26.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND27.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND28.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND29.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND2A.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND2B.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND2C.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND2D.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND2E.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND2F.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND3.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND30.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND31.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND32.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND33.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND34.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND35.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND36.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND37.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND38.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND39.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND3A.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND3B.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND3C.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND3D.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND3E.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND3F.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND4.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND40.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND41.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND42.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND43.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND5.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND6.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND7.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND8.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FND9.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FNDA.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FNDB.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FNDC.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FNDD.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FNDE.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\cache\FNDF.NFI High Backdoor.Agent.AIRC:\Program Files\ESET\dmon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\emon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\eset.chm High Backdoor.Agent.AIRC:\Program Files\ESET\Install High Backdoor.Agent.AIRC:\Program Files\ESET\Install\advheur.nup High Backdoor.Agent.AIRC:\Program Files\ESET\Install\archs.nup High Backdoor.Agent.AIRC:\Program Files\ESET\Install\charon.nup High Backdoor.Agent.AIRC:\Program Files\ESET\Install\engine.nup High Backdoor.Agent.AIRC:\Program Files\ESET\Install\main.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Install\mainlang.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Install\mfc42.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Install\mfc42u.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Install\msvcrt.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Install\ntbasepl.nup High Backdoor.Agent.AIRC:\Program Files\ESET\Install\ntinetpl.nup High Backdoor.Agent.AIRC:\Program Files\ESET\Install\ntstdpl.nup High Backdoor.Agent.AIRC:\Program Files\ESET\Install\pwscan.nup High Backdoor.Agent.AIRC:\Program Files\ESET\Install\readme.txt High Backdoor.Agent.AIRC:\Program Files\ESET\Install\setup.exe High Backdoor.Agent.AIRC:\Program Files\ESET\Install\setup.xml High Backdoor.Agent.AIRC:\Program Files\ESET\Install\utilmod.nup High Backdoor.Agent.AIRC:\Program Files\ESET\logs High Backdoor.Agent.AIRC:\Program Files\ESET\logs\nod32 High Backdoor.Agent.AIRC:\Program Files\ESET\logs\nod32\NDL29061.DAT High Backdoor.Agent.AIRC:\Program Files\ESET\logs\virlog.dat High Backdoor.Agent.AIRC:\Program Files\ESET\logs\warnlog.dat High Backdoor.Agent.AIRC:\Program Files\ESET\nod.ovl High Backdoor.Agent.AIRC:\Program Files\ESET\nod32.000 High Backdoor.Agent.AIRC:\Program Files\ESET\nod32.002 High Backdoor.Agent.AIRC:\Program Files\ESET\nod32.003 High Backdoor.Agent.AIRC:\Program Files\ESET\nod32.004 High Backdoor.Agent.AIRC:\Program Files\ESET\nod32.005 High Backdoor.Agent.AIRC:\Program Files\ESET\nod32.006 High Backdoor.Agent.AIRC:\Program Files\ESET\nod32.chm High Backdoor.Agent.AIRC:\Program Files\ESET\nod32.exe High Backdoor.Agent.AIRC:\Program Files\ESET\nod32.log High Backdoor.Agent.AIRC:\Program Files\ESET\nod32api.dll High Backdoor.Agent.AIRC:\Program Files\ESET\nod32ari.dll High Backdoor.Agent.AIRC:\Program Files\ESET\nod32aui.dll High Backdoor.Agent.AIRC:\Program Files\ESET\nod32fix.reg High Backdoor.Agent.AIRC:\Program Files\ESET\nod32krn.exe High Backdoor.Agent.AIRC:\Program Files\ESET\nod32krr.dll High Backdoor.Agent.AIRC:\Program Files\ESET\nod32kui.chm High Backdoor.Agent.AIRC:\Program Files\ESET\nod32kui.exe High Backdoor.Agent.AIRC:\Program Files\ESET\nod32r.dll High Backdoor.Agent.AIRC:\Program Files\ESET\nod32rui.dll High Backdoor.Agent.AIRC:\Program Files\ESET\nodshex.dll High Backdoor.Agent.AIRC:\Program Files\ESET\nodshex64.dll High Backdoor.Agent.AIRC:\Program Files\ESET\pr_amon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\pr_dmon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\pr_emon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\pr_imon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\pr_nod32.dll High Backdoor.Agent.AIRC:\Program Files\ESET\pr_upd.dll High Backdoor.Agent.AIRC:\Program Files\ESET\ps_amon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\ps_amon64.dll High Backdoor.Agent.AIRC:\Program Files\ESET\ps_dmon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\ps_emon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\ps_nod32.dll High Backdoor.Agent.AIRC:\Program Files\ESET\ps_upd.dll High Backdoor.Agent.AIRC:\Program Files\ESET\pu_amon.chm High Backdoor.Agent.AIRC:\Program Files\ESET\pu_amon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\pu_dmon.chm High Backdoor.Agent.AIRC:\Program Files\ESET\pu_dmon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\pu_emon.chm High Backdoor.Agent.AIRC:\Program Files\ESET\pu_emon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\pu_imon.chm High Backdoor.Agent.AIRC:\Program Files\ESET\pu_imon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\pu_nod32.dll High Backdoor.Agent.AIRC:\Program Files\ESET\pu_upd.chm High Backdoor.Agent.AIRC:\Program Files\ESET\pu_upd.dll High Backdoor.Agent.AIRC:\Program Files\ESET\readme.txt High Backdoor.Agent.AIRC:\Program Files\ESET\Setup High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\00 High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\00\krnstp.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\00\krnstpr.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\00\krnvis.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\00\pr_upd.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\00\ps_upd.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\00\pu_upd.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\01 High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\01\ps_amon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\01\ps_dmon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\01\ps_nod32.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\01\pu_amon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\01\pu_dmon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\01\pu_nod32.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\02 High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\02\imon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\02\pr_emon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\02\pr_imon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\02\ps_emon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\02\pu_emon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\02\pu_imon.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\main.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\mainlang.dll High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\setup.exe High Backdoor.Agent.AIRC:\Program Files\ESET\Setup\uninst.xml High Backdoor.Agent.AIRC:\Program Files\ESET\sporder.dll High Backdoor.Agent.AIRC:\Program Files\ESET\unins000.dat High Backdoor.Agent.AIRC:\Program Files\ESET\unins000.exe High Backdoor.Agent.AIRC:\Program Files\ESET\updfiles High Backdoor.Agent.AIRC:\Program Files\ESET\updfiles\lastupd.ver High Backdoor.Agent.AIRC:\Program Files\ESET\updfiles\nod0967.nup High Backdoor.Agent.AIRC:\Program Files\ESET\updfiles\nod0F4A.nup High Backdoor.Agent.AIRC:\Program Files\ESET\updfiles\nod1036.nup High Backdoor.Agent.AIRC:\Program Files\ESET\updfiles\nod10F1.nup High Backdoor.Agent.AIRC:\Program Files\ESET\updfiles\nod16D7.nup High Backdoor.Agent.AIRC:\Program Files\ESET\updfiles\nod2685.nup High Backdoor.Agent.AIRC:\Program Files\ESET\updfiles\nod2767.nup High Backdoor.Agent.AIRC:\Program Files\ESET\updfiles\nod296C.nup High Backdoor.Agent.AIRC:\Program Files\ESET\updfiles\nod2D9F.nup High Backdoor.Agent.AIRC:\Program Files\ESET\updfiles\nod349B.nup High Backdoor.Agent.AIRC:\Program Files\ESET\updfiles\nod40FB.nup High Backdoor.Agent.AIRC:\Program Files\ESET\updfiles\nod461C.nup High Backdoor.Agent.AIRC:\Program Files\ESET\updfiles\nod6821.nup High Backdoor.Agent.AIRC:\Program Files\ESET\updfiles\nod6AF7.nup High Backdoor.Agent.AIRC:\Program Files\ESET\updfiles\upd.ver High Tracking Cookie(s)cookies.txt - Line #117 Low Tracking Cookie(s)cookies.txt - Line #118 Low Tracking Cookie(s)cookies.txt - Line #119 Low Tracking Cookie(s)cookies.txt - Line #127 Low Tracking Cookie(s)cookies.txt - Line #132 Low Tracking Cookie(s)cookies.txt - Line #133 Low Tracking Cookie(s)cookies.txt - Line #134 Low Tracking Cookie(s)cookies.txt - Line #225 Low Tracking Cookie(s)cookies.txt - Line #226 Low Tracking Cookie(s)cookies.txt - Line #227 Low Advertisingcookies.txt - Line #229 Low Tracking Cookie(s)cookies.txt - Line #253 Low Advertisingcookies.txt - Line #296 Low Tracking Cookie(s)cookies.txt - Line #333 Low Tracking Cookie(s)cookies.txt - Line #336 Low Tracking Cookie(s)cookies.txt - Line #39 Low Advertisingcookies.txt - Line #42 Low Advertisingcookies.txt - Line #422 Low Advertisingcookies.txt - Line #53 Low Known Bad Sitescookies.txt - Line #82 High Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3} High Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}## High Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Implemented Categories High Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Implemented Categories## High Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49} High Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}## High Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\InprocServer32 High Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\InprocServer32## High Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\InprocServer32##ThreadingModel High Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\ProgID High Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\ProgID## High Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Programmable High Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Programmable## High Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\TypeLib High Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\TypeLib## High Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\VersionIndependentProgID High Backdoor.Agent.AIRHKCR\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\VersionIndependentProgID## High Backdoor.Agent.AIRHKCR\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D} High Backdoor.Agent.AIRHKCR\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}## High Backdoor.Agent.AIRHKCR\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32 High Backdoor.Agent.AIRHKCR\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32## High Backdoor.Agent.AIRHKCR\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32##ThreadingModel High cenzura-spam DialerHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\1987324.com High cenzura-spam DialerHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\1987324.com## High cenzura-spam DialerHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\1987324.com##* High cenzura-spam DialerHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\1987324.com\www High cenzura-spam DialerHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\1987324.com\www## High cenzura-spam DialerHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\1987324.com\www##* High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3} High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}## High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Implemented Categories High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Implemented Categories## High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49} High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}## High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\InprocServer32 High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\InprocServer32## High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\InprocServer32##ThreadingModel High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\ProgID High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\ProgID## High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Programmable High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\Programmable## High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\TypeLib High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\TypeLib## High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\VersionIndependentProgID High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{68DA9FAB-4A6A-4975-A1CA-B50E56B1F4F3}\VersionIndependentProgID## High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D} High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}## High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32 High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32## High Backdoor.Agent.AIRHKLM\Software\Classes\CLSID\{B089FE88-FB52-11D3-BDF1-0050DA34150D}\InProcServer32##ThreadingModel High Backdoor.Agent.AIRHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved##{B089FE88-FB52-11D3-BDF1-0050DA34150D} High Other Sections: Copyright © 2003 PC Tools. All rights reserved.Legal Notice sigs Click to go back

proszę o sprawdzenie

proszę o sprawdzenie

Kto jest na forum